# Wazuh behind traefik on tcp port

**URL:** <https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338>\
**Category:** Traefik v2\
**Tags:** file, tcp\
**Created:** [November 1, 2023, 4:36pm UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338 "2023-11-01T16:36:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ncontinisio](https://avatars.discourse-cdn.com/v4/letter/n/ebca7d/32.png) [@ncontinisio](https://community.traefik.io/u/ncontinisio)\
**Post date:** [November 1, 2023, 4:36pm UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338/1 "2023-11-01T16:36:24Z")

</div>

Hi, I'm having trouble getting wazuh to work behind traefik.  
I installed wazuh in a proxmox container and connected via traefik, installed in another container running docker and where traefik is installed.  
Questa è la configurazione del dynamics file :  
dynamics.yml:

```auto
http:
  routers:
    wazuh-router:
      rule: "Host(`wazuh.example.com`)"
      entryPoints:
        - websecure
      service: wazuh-service
      tls:
        certResolver: dns01
services:
    wazuh-service:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://10.20.40.2:443"

tcp:
  routers:
    wazuh-r1515:
      entryPoints:
        - 1515/tcp
      rule: "HostSNI(`wazuh.example.com`)"
      service: wazuh-s1515
      tls:
        certResolver: dns01
services:
    wazuh-s1515:
      loadBalancer:
        servers:
        - address: 10.20.40.2:1515

```

In the static configuration I created an entrypoint:

```auto
entryPoints:
 1515/tcp:
    address: :1515/tcp

```

the traefik dashboard shows no errors.  
I have an internal DNS server with bind9 and I pointed the domain towards traefik, in fact the wazuh dashboard is reachable, but if I configure the wazuh agent with [wazuh.example.com](http://wazuh.example.com) it doesn't work. On Traefik open all the TCP ports that Wazuh requires, to simplify I have given you the example of one since I configured the others in the exact same way.  
if I try to nmap [wazuh.example.com](http://wazuh.example.com) -p 1515 I get the port open:

```auto
Host is up (0.014s latency).

PORT STATE SERVICE
1515/tcp open ifor-protocol

```

But if I configure the agent the connection does not occur, unlike making it point directly to the IP, same result with zabbix.  
I can't figure out if it's a traefik configuration error or I need to look elsewhere.  
Any suggestions?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 1, 2023, 5:06pm UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338/2 "2023-11-01T17:06:53Z")

</div>

Share your full Traefik static and dynamic config, and `docker-compose.yml` if used.

Enable and check Traefik debug log.

I recommend to use regular alphanumeric characters for names/labels. We see in Traefik examples that `-` works, too. Would not use other special characters like `/`.

---

<div class="post-metadata">

**Author:** ![ncontinisio](https://avatars.discourse-cdn.com/v4/letter/n/ebca7d/32.png) [@ncontinisio](https://community.traefik.io/u/ncontinisio)\
**Post date:** [November 1, 2023, 5:49pm UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338/3 "2023-11-01T17:49:41Z")

</div>

Dynamics:

```auto
http:
  routers:
    bookstack-router:
      rule: "Host(`kb.lab.local`)"
      entryPoints:
        - websecure
      service: bookstack-service
      tls:
        certResolver: production

    proxmox-router:
      rule: "Host(`proxmox.lab.local`)"
      entryPoints:
        - websecure
      service: proxmox-service
      tls:
        certResolver: dns01

    portainer-router:
      rule: "Host(`portainer.lab.local`)"
      entryPoints:
        - websecure
      service: portainer-service
      tls:
        certResolver: dns01

    wazuh-router:
      rule: "Host(`wazuh.lab.local`)"
      entryPoints:
        - websecure
      service: wazuh-service
      tls:
        certResolver: dns01

    zabbix-router:
      rule: "Host(`zabbix.lab.local`)"
      entryPoints:
        - websecure
      service: zabbix-service
      tls:
        certResolver: dns01

##############################################################
  services:
    bookstack-service:
      loadBalancer:
        servers:
          - url: "http://10.20.40.9:443"
          
    proxmox-service:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://10.20.40.1:8006"

    portainer-service:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://10.20.40.6:9443"

    wazuh-service:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://10.20.40.2:443"

    zabbix-service:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "http://10.20.40.8/zabbix"
          
# Middlewares http
# ---
  middlewares:
    crowdsec-bouncer:
      forwardauth:
        address: http://bouncer-traefik:8080/api/v1/forwardAuth
        trustForwardHeader: true

  serversTransports:
    insecureTransport:
      insecureSkipVerify: true

#########TCP##############################
tcp:
  routers:
    wazuh-r55000:
      entryPoints:
        - 55000/tcp
      rule: "HostSNI(`wazuh.lab.local`)"
      service: wazuh-s55000
      tls:
        certResolver: dns01

    wazuh-r1514tcp:
      entryPoints:
        - 1514/tcp
      rule: "HostSNI(`wazuh.lab.local`)"
      service: wazuh-s1514tcp
      tls:
        certResolver: dns01

    wazuh-r1515:
      entryPoints:
        - 1515/tcp
      rule: "HostSNI(`wazuh.lab.local`)"
      service: wazuh-s1515
      tls:
        certResolver: dns01

    wazuh-r1516:
      entryPoints:
        - 1516/tcp
      rule: "HostSNI(`wazuh.lab.local`)"
      service: wazuh-s1516
      tls:
        certResolver: dns01

    zabbix-r10050:
      entryPoints:
        - 10050/tcp
      rule: "HostSNI(`zabbix.lab.local`)"
      service: zabbix-s10050
      tls:
        certResolver: dns01

    zabbix-r10051:
      entryPoints:
        - 10051/tcp
      rule: "HostSNI(`zabbix.lab.local`)"
      service: zabbix-s10051
      tls:
        certResolver: dns01

  services:
    wazuh-s55000:
      loadBalancer:
        servers:
        - address: 10.20.40.2:55000

    wazuh-s1514tcp:
      loadBalancer:
        servers:
        - address: 10.20.40.2:1514

    wazuh-s1515:
      loadBalancer:
        servers:
        - address: 10.20.40.2:1515

    wazuh-s1516:
      loadBalancer:
        servers:
        - address: 10.20.40.2:1516

    zabbix-s10050:
      loadBalancer:
        servers:
        - address: 10.20.40.8:10050

    zabbix-s10051:
      loadBalancer:
        servers:
        - address: 10.20.40.8:10051

```

static:

```auto
global:
  checkNewVersion: true
  sendAnonymousUsage: false # true by default

# (Optional) Log information
# ---
log:
  level: DEBUG # DEBUG, INFO, WARNING, ERROR, CRITICAL
  format: common # common, json, logfmt
  filePath: /var/log/traefik/traefik.log

# (Optional) Accesslog
# ---
accesslog:
   format: common # common, json, logfmt
   filePath: /var/log/traefik/access.log

# (Optional) Enable API and Dashboard
# ---
api:
  dashboard: true # true by default
  insecure: true # Don't do this in production!

# Entry Points configuration
# ---
entryPoints:
  web:
    address: :80
    http:
      middlewares:
        - crowdsec-bouncer@file
    # (Optional) Redirect to HTTPS
    # ---
    # http:
    # redirections:
    # entryPoint:
    # to: websecure
    # scheme: https

  websecure:
    address: :443
    http:
      middlewares:
        - crowdsec-bouncer@file
  1514/tcp:
    address: :1514/tcp
  1515/tcp:
    address: :1515/tcp
  1516/tcp:
    address: :1516/tcp
  55000/tcp:
    address: :55000/tcp
  10050/tcp:
    address: :10050/tcp
  10051/tcp:
    address: :10051/tcp

certificatesResolvers:
# staging:
# acme:
# email: your-email@example.com
# storage: /etc/traefik/certs/acme.json
# caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
# httpChallenge:
# entryPoint: web
#
    production:
     acme:
       email: <MYEMAIL>
       storage: acme.json
       caServer: "https://acme-v02.api.letsencrypt.org/directory"
       httpChallenge:
         entryPoint: web

    dns01:
     acme:
       email: <MYEMAIL>
       storage: acme.json
       dnsChallenge:
         provider: cloudflare
         disablePropagationCheck: true
         delayBeforeCheck: 60
         resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

# (Optional) Overwrite Default Certificates
# tls:
# stores:
# default:
# defaultCertificate:
# certFile: /etc/traefik/certs/cert.pem
# keyFile: /etc/traefik/certs/cert-key.pem
# (Optional) Disable TLS version 1.0 and 1.1
# options:
# default:
# minVersion: VersionTLS12

providers:
  docker:  
    exposedByDefault: false # Default is true
    watch: true
  file:
    # watch for dynamic configuration changes
    directory: /dynamic_config
    watch: true

```

Docker Compose:

```auto
version: '3'

services:
  traefik:
    image: "traefik:latest"
    container_name: "traefik"
    restart: always
    ports:
      - "80:80" #web
      - "443:443" #websecure
      #Dashboard
      - "8080:8080"
      - "1514:1514"
      - "1514:1514/udp"
      - "1515:1515"
      - "1516:1516"
      - "55000:55000/tcp"
      - "514:514/udp"
    networks:
     proxynet:
      ipv4_address: 172.18.0.2
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro      
      #Dati
      - /mnt/docker/volumi/traefik/:/etc/traefik #configurazione traefik
      - /mnt/docker/volumi/traefik/log:/var/log/traefik/
      - /mnt/docker/volumi/traefik/cert/acme.json:/acme.json #certificati ssl
      - /mnt/docker/volumi/traefik/dynamic_config/:/dynamic_config:ro

    environment:
      - "CF_API_EMAIL=<MYEMAIL>"
      - "CF_API_KEY=<KEY>"

networks:
  proxynet:
    external: true

```

Debug log shows no errors for wazuh configuration

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 2, 2023, 8:57am UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338/4 "2023-11-02T08:57:01Z")

</div>

Which wazuh image do you run? Did you try to connect your client directly to the target container port?

The way you configured it, Traefik will terminate TLS and forward unencrypted data. Does wazuh expect an encrypted connection?

---

<div class="post-metadata">

**Author:** ![ncontinisio](https://avatars.discourse-cdn.com/v4/letter/n/ebca7d/32.png) [@ncontinisio](https://community.traefik.io/u/ncontinisio)\
**Post date:** [November 2, 2023, 9:16am UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338/5 "2023-11-02T09:16:28Z")

</div>

Wazuh is installed inside a lxc proxmox container, I followed the instructions in their documentation for installing on debian.  
If I use the server's IP address, communication is ok.  
I tried to edit like this but it does not work:

```auto
   wazuh-r1515:
      entryPoints:
        - p1515tcp
      rule: "HostSNI(`wazuh.lab.local`)"
      service: wazuh-s1515
      tls:
        passthrough: true

```

if I eliminate the passthrough instead and set HostSNI(\*) it works:

```auto
   wazuh-r1515:
      entryPoints:
        - p1515tcp
      rule: "HostSNI(`wazuh.lab.local`)"
      service: wazuh-s1515

```

On wazuh there are self-signed certificates, from traefik I set let's encrypt, could this be the problem?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 2, 2023, 10:44am UTC](https://community.traefik.io/t/wazuh-behind-traefik-on-tcp-port/20338/6 "2023-11-02T10:44:30Z")

</div>

Yeah, TLS in front and back is always a bit more complicated.

```auto
tls:
        passthrough: true

```

only works when Traefik and target service share the same cert.

When Traefik uses LetsEncrypt, this is a challenge because you would need to export the LE cert like every 3 months and share it with the target service.

If you want to use different certs in front an back, you need to tell Traefik `service` to use the cert or a `insecureskipverify` transport.

If you want to use the custom cert from your target service, then you need to share it with Traefik to use regular `HostSNI()` with domain name.

If Traefik does not have a cert, then you can not activate any TLS on the entrypoint (port) and only use a TCP router with `HostSNI(`*`)`.