# Traefik + Docker + sftpgo - tcp connection issues **URL:** \ **Category:** Traefik v2\ **Tags:** tcp, docker\ **Created:** [October 3, 2023, 2:06pm UTC](https://community.traefik.io/t/traefik-docker-sftpgo-tcp-connection-issues/20063 "2023-10-03T14:06:02Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Aim](https://avatars.discourse-cdn.com/v4/letter/a/bc8723/32.png) [@Aim](https://community.traefik.io/u/Aim)\ **Post date:** [October 3, 2023, 2:06pm UTC](https://community.traefik.io/t/traefik-docker-sftpgo-tcp-connection-issues/20063/1 "2023-10-03T14:06:02Z")
I've had my head around sftpgo and the docker container the last weekend. My config works as far as, that I can reach the web ui of sftpgo, but I cannot establish a tcp/sftp connection to that container. traefik.yaml ```yaml entryPoints: http: address: ":80" http: redirections: entryPoint: to: "https" scheme: "https" https: address: ":443" http: middlewares: - crowdsec-bouncer@file sftp: address: ":2222/tcp" ``` sftpgo docker-compose.yaml ```yaml version: "3.0" services: sftpgo: image: drakkan/sftpgo:v2.5.4-alpine container_name: sftpgo # Peer-facing ports expose: - "1111/tcp" - "2222/tcp" environment: # Proxy Protocol - "SFTPGO_COMMON__PROXY_PROTOCOL=2" - "SFTPGO_COMMON__PROXY_ALLOWED=0.0.0.0" # SFTP - "SFTPGO_SFTPD __BINDINGS__ 0__PORT=1111" - "SFTPGO_SFTPD __BINDINGS__ 0__PROXY_ALLOWED=0.0.0.0" # HTTP - "SFTPGO_HTTPD __BINDINGS__ 0__PORT=2222" - "SFTPGO_HTTPD __BINDINGS__ 0__PROXY_ALLOWED=0.0.0.0" # Defender (similar concept as Fail2ban) — see https://github.com/drakkan/sftpgo/blob/main/docs/defender.md - "SFTPGO_COMMON __DEFENDER__ ENABLED=true" - "SFTPGO_COMMON __DEFENDER__ BAN_TIME=30" - "SFTPGO_COMMON __DEFENDER__ BAN_TIME_INCREMENT=50" - "SFTPGO_COMMON __DEFENDER__ THRESHOLD=15" - "SFTPGO_COMMON __DEFENDER__ OBSERVATION_TIME=30" volumes: - /opt/containers/sftpgo/data:/srv/sftpgo/data - /opt/containers/sftpgo/backups:/srv/sftpgo/backups - /opt/containers/sftpgo/config:/var/lib/sftpgo labels: - "traefik.enable=true" - "traefik.tcp.routers.sftpgo-tcp.entrypoints=sftp" - "traefik.tcp.routers.sftpgo-tcp.rule=HostSNI(`*`)" - "traefik.tcp.routers.sftpgo-tcp.tls=false" - "traefik.tcp.routers.sftpgo-tcp.service=sftpgo-tcp-proxy" - "traefik.tcp.services.sftpgo-tcp-proxy.loadbalancer.server.port=1111" - "traefik.http.routers.sftpgo.entrypoints=http" - "traefik.http.routers.sftpgo.rule=Host(`sftpgo.example.com`)" - "traefik.http.routers.sftpgo-secure.entrypoints=https" - "traefik.http.routers.sftpgo-secure.rule=Host(`sftpgo.example.com`)" - "traefik.http.routers.sftpgo-secure.tls=true" - "traefik.http.routers.sftpgo-secure.tls.certresolver=http" - "traefik.http.routers.sftpgo-secure.service=sftpgo-proxy" - "traefik.http.services.sftpgo-proxy.loadbalancer.server.port=2222" - "traefik.docker.network=proxy" networks: - proxy restart: unless-stopped networks: proxy: external: true ``` In the webui I can see, that the sftp server is running [![enter image description here](https://i.stack.imgur.com/Lu9V8.png)](https://i.stack.imgur.com/Lu9V8.png) return of docker ps (seems like, ports are populated): ```bash a7a581a23a90 drakkan/sftpgo:v2.5.4-alpine "sftpgo serve" 5 minutes ago Up 5 minutes 1111/tcp, 2222/tcp sftpgo ``` checked firewall rules, seems ok. traefik dashboard looking fine for me as well: [![enter image description here](https://i.stack.imgur.com/3RQgt.png)](https://i.stack.imgur.com/3RQgt.png) Test connection from the docker hostmachine. Same results from external connection ```bash {13:55:10} root@docker-live:[/opt/containers/sftpgo]: sftp -oPort=2222 testuser@localhost ssh: connect to host localhost port 2222: Connection refused Connection closed. Connection closed {13:55:20} root@docker-live:[/opt/containers/sftpgo]: sftp -oPort=1111 testuser@localhost ssh: connect to host localhost port 1111: Connection refused Connection closed. Connection closed ``` My guess is, that the loadbalancer of traefik is not probably working and I have misconfigured something. But I cannot figure it out, what's wrong here. Any direction where I can take a closer look, would help. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [October 3, 2023, 6:14pm UTC](https://community.traefik.io/t/traefik-docker-sftpgo-tcp-connection-issues/20063/2 "2023-10-03T18:14:12Z")
Seems you mixed up 1111 and 2222. Create your sftp `entrypoint` with 1111 and make sure you open the container port. ---
**Author:** ![mtracz](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mtracz/32/8296_2.png) [@mtracz](https://community.traefik.io/u/mtracz)\ **Post date:** [February 20, 2024, 11:02pm UTC](https://community.traefik.io/t/traefik-docker-sftpgo-tcp-connection-issues/20063/3 "2024-02-20T23:02:15Z")
Try to set proxy protocol manually on tcp service. Looks like Traefik is not setting it up by default, but I am not sure. I'm using traefik:v2.10.7. ```auto - "traefik.tcp.services..loadbalancer.proxyprotocol.version=2" ``` In your case: ```auto - "traefik.tcp.services.sftpgo-tcp-proxy.loadbalancer.proxyprotocol.version=2" ``` Then you can try to connect on **2222** (traefik entrypoint) which is pointing to 1111 sftpgo port inside container. It solved my problems. My config, most important settings (I didn't setup allowed proxies in sftpgo config): ```auto # Traefik static config, entrypoints sftpgo: address: ":2022" # Traefik docker-compose ports: - 2022:2022 # sftpgo docker-compose labels: - "traefik.enable=true" - "traefik.tcp.routers.sftpgo.rule=HostSNI(`*`)" - "traefik.tcp.routers.sftpgo.entrypoints=sftpgo" - "traefik.tcp.services.sftpgo-service.loadbalancer.server.port=2022" - "traefik.tcp.services.sftpgo-service.loadbalancer.proxyprotocol.version=2" expose: - 2022 environment: - SFTPGO_SFTPD __BINDINGS__ 0__PORT=2022 - SFTPGO_COMMON__PROXY_PROTOCOL=2 ```