Traefik secure issues

[Grimmrp2]

hi i followed this your YouTube guide here https://youtu.be/IBlZgrwc1T8?si=QMjnL0tmoqBh6piI and used the traefik-secure docs here https://github.com/JamesTurland/JimsGarage/tree/main/Traefik-Secure

Made all nessasery canges to yml files and get to the log back in to traefik dashboard about 8 mins 16 seconds and no mater what port i use eg.

192.168.0.7:80
192.168.0.7:81
192.168.0.7:443
192.168.0.7:444

i get a 404 page not found error

docker-compose

version: '3'

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
       proxy:
    ports:
      - 80:80
      - 81:81 # external http
      - 443:443
      - 444:444 # external https
    environment:
      - [email protected]
      - CF_DNS_API_TOKEN=sn5LXLvygyfyfyfyf
      # - CF_API_KEY=YOU_API_KEY
      # be sure to use the correct one depending on if you are using a token or key
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/user/docker/traefik/traefik.yml:/traefik.yml:ro
      - /home/user/docker/traefik/acme.json:/acme.json
      - /home/user/docker/traefik/config.yml:/config.yml:ro
      - /home/user/docker/traefik/logs:/var/log/traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http" # restricts dashboard to internal entrypoint
      - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.firesand.xyz`)" # if you want a internal domain, get the wildcard cert for it and then choos traefik-dashboard.home.firesand.xyz or what you want
      - "traefik.http.middlewares.traefik-auth.basicauth.users=user:$$apr1$$xbeynWpH$$nEqvtGTGgS4/"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.fires.xyz`)" # if you want a internal domain, get the wildcard cert for it and then choos traefik-dashboard.home.firesand.xyz or what you want
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
      #- "traefik.http.routers.traefik-secure.tls.domains[0].main=home.fires.xyz" # If you want *.home.fires.xyz subdomain or something else, you have to get the certifcates at first
      #- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.home.fires.xyz" # get a wildcard certificat for your .home.fires.xyz
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=fires.xyz" #if you use the .home.firesand.xyz entry you have to change the [0] into [1]
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.fires.xyz" # same here, change 0 to 1
      - "traefik.http.routers.traefik-secure.service=api@internal"

networks:
  proxy:
    external: true

traefik.yml

api:
  dashboard: true
  debug: true
entryPoints:
  http:
    address: ":80"
    http:
      middlewares:
        #- crowdsec-bouncer@file
      redirections:
        entrypoint:
          to: https
          scheme: https
  https:
    address: ":443"
    http:
      middlewares:
        #- crowdsec-bouncer@file
  http-external:
    address: ":81"
    http:
      middlewares:
       # - crowdsec-bouncer@file
      redirections:
        entrypoint:
          to: https-external
          scheme: https
  https-external:
    address: ":444"
    http:
      middlewares:
        #- crowdsec-bouncer@file

serversTransport:
  insecureSkipVerify: true
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /config.yml
certificatesResolvers:
  cloudflare:
    acme:
      email: [email protected]
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all authoritative name servers.
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

log:
  level: "INFO"
  filePath: "/var/log/traefik/traefik.log"
accessLog:
  filePath: "/var/log/traefik/access.log"

I have changed the sensitive parts names passwords ect.

any help would be great

Thanka

[f616]

I think you should go to your pi-hole (or your local DNS server) and point the traefik-dashboard.firesand.xyz to your traefik IP.

Then in the browser you should be able to connect to https://traefik-dashboard.firesand.xyz/dashboard

If you haven't deployed a local DNS server, my guess would be editing your hosts file.

Hope it helped

[Grimmrp2]

I think you should go to your pi-hole (or your local DNS server) and point the traefik-dashboard.firesand.xyz to your traefik IP.

traefik-dashboard.firesand.xyz

Then in the browser you should be able to connect to https://traefik-dashboard.firesand.xyz/dashboard

If you haven't deployed a local DNS server, my guess would be editing your hosts file.

Hope it helped

Thanks i havent set up pihole yet but ive added traefik-dashboard.firesand.xyz to hosts file

but get

[StianNOR]

Same here went from 404 and now it just blank page. Maybe go deeper into it for the noobs hahaha.

[CommittotheIndian]

I'm having the exact same issue. If I use the http-external label it works fine. As soon as I add https-external label, I get the 404 not found.

[f616]

Thanks i havent set up pihole yet but ive added traefik-dashboard.firesand.xyz to hosts file

but get

I'm no expert at all, I've also be struggle with traefik, but check your .rules, don't know if that's an issue, or not, but you have different domains on both.

[CommittotheIndian]

The typo might work for OP but I'm still having the issue. Has anyone else resolved it?

sg="accept tcp [::]:444: use of closed network connection" entryPointName=https-external
time="2024-05-02T15:56:14-04:00" level=error msg="accept tcp [::]:443: use of closed network connection" entryPointName=https
time="2024-05-02T15:56:14-04:00" level=error msg="accept tcp [::]:81: use of closed network connection" entryPointName=http-external
time="2024-05-02T15:56:14-04:00" level=error msg="accept tcp [::]:80: use of closed network connection" entryPointName=http
time="2024-05-02T15:56:14-04:00" level=error msg="close tcp [::]:80: use of closed network connection" entryPointName=http
time="2024-05-02T15:56:14-04:00" level=error msg="close tcp [::]:81: use of closed network connection" entryPointName=http-external
time="2024-05-02T15:56:14-04:00" level=error msg="Error while starting server: accept tcp [::]:444: use of closed network connection" entryPointName=https-external
time="2024-05-02T15:56:14-04:00" level=error msg="close tcp [::]:443: use of closed network connection" entryPointName=https

[etuckeriv]

I'm also having the same issue. Been going crazy redoing my compose files, config files, NAT rules, looking for typos and whatnot, I can't find anything wrong with any of it but I still get the 404 error when using the https-external entrypoint

[etuckeriv]

Ok, I'm not entirely sure what I did, but I got this working finally.

I can say that I didn't end up changing anything with the traefik configs or the configs for my exposed services, my issue was with my network/firewall.

I am using pfSense behind an AT&T gateway. From what I can tell, I was experiencing issues due to "asymmetric routing", so if you aren't using a similar setup to mine, try researching "asymmetric routing" related to the firewall/router in your setup. I believe the main issue was that my pfSense firewall was pulling a private IP from my Gateway on the WAN interface instead of the Gateway passing through my public IP to pfSense like it should. I went back through the setup for configuring IP Passthrough Mode on the Gateway and rebooted both the Gateway and the firewall, and the firewall started pulling the public IP for my WAN interface correctly.

This still didn't work at first, and I had tried a bunch of different settings tweaks and different ideas in pfSense that didn't work before I noticed my firewall was pulling a private IP on WAN. So I went through and undid those changes and I was finally able to access my services on the "https-external" entrypoint!

One other thing I did before that I didn't undo (though I'm not sure makes any difference), is to create the port forward/translations for both IPv4 and IPv6.

Also a note if you're using pfSense: the "hairpin NAT" that Jim references in his video doesn't seem to be enabled by default in pfSense. You can enable it at System > Advanced > Firewall & NAT, scroll down to the Network Address Translation section, choose "Pure NAT" from the NAT Reflection mode for port forwards drop-down, and then at the bottom of that section check the box for Enable automatic outbound NAT for Reflection.