rivaling http and tcp router with wrong priority about traefik HOT 4 CLOSED

Hello @rtribotte , thank you for your reply.

Yes, that issue matches mine. The documentation misses any mention of a different handling of tcp and tls-tcp, similar to http. $someone should find the chance to update this, since I've found multiple similar issues in your own community forum regarding the same confusion.

And while we're on it: Is there any preferred solution to my original question? I'm not a big fan of re-encrypting the traffic multiple times if there's no need for that. And somewhere on that way I'm loosing the original client ip... different issue.

from traefik.

Hello @max06,

Thanks for reporting this!

This seems to be the same report as #10186.
Please take a look at #10186 (comment) for more explanations.
I'm closing this issue as a duplicate, but don't hesitate to reopen it if you think this is not the case.

from traefik.

Hello @max06,

To make the catchAll TCP-TLS router take precedence over the HTTPS catchAll router, you can redefine the TCP-TLS router rule to prevent Traefik from considering it as a "catchAll" rule, while being a rule matching any host.

tcp:
  routers:
    catchall:
      entryPoints:
        - secure
      service: catchall
      # keep the catchAll behavior in regards to matching, but prevent Traefik from detecting this as a "catchAll" router.
      rule: !HostSNI(`foobar`)
      priority: 1
      tls:
        passthrough: true

This is only an example, the rule HostSNI(`*`) || HostSNI(`*`) would have worked too.
Here is the explanation of why:

from traefik.

Oh no.... I was so close 😂

Thank you, I'll give it a try this evening!

from traefik.