如何配置Traefik让Portainer通过独立端口暴露（保留80/443）

我基于portaefik项目部署了Traefik前置Portainer，目前运行正常，还通过这套架构托管了其他多个服务。现在我想让Portainer管理界面不再通过常规的80/443端口访问，改用独立端口（比如9443），这样就能在防火墙里对这个端口做IP过滤，只允许我自己访问。请问怎么配置Traefik实现这个需求，同时保持其他服务继续通过80/443端口提供服务？之前的尝试都失败了，导致Traefik或Portainer无法正常运行。

当前docker-compose配置：

version: "3"

services:
  proxy:
    image: traefik:v3.0
    container_name: "traefik"
    networks:
      - traefik
    ports:
      - "80:80" # HTTP
      - "443:443" # HTTPS
    volumes:
      - ./letsencrypt:/letsencrypt
      - ./users.u:/users/users.u
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: always
    command:
      #- "--log.level=DEBUG"
      # Docker configuration
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik"
      # Configure entrypoint
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      # SSL configuration
      - "--certificatesresolvers.letsencryptresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencryptresolver.acme.httpchallenge.entrypoint=web"
      #- "--certificatesresolvers.letsencryptresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.letsencryptresolver.acme.email=none@none.com"
      - "--certificatesresolvers.letsencryptresolver.acme.storage=/letsencrypt/acme.json"
      # Global HTTP -> HTTPS
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      # Enable dashboard
      - "--api.dashboard=true"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencryptresolver"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.usersfile=/users/users.u"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.mydomain.se`)"
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
  
  portainer:
    image: portainer/portainer-ce
    container_name: "portainer"
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
      - "traefik.http.routers.portainer.rule=Host(`portainer.mydomain.se`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.tls.certresolver=letsencryptresolver"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /mnt/Storage1/docker-data/portainer:/data
    restart: always

networks:
  traefik:
    external:
      name: traefik

实现步骤 #

1. 给Traefik添加Portainer专属入口点 #

在Traefik服务中新增端口映射和入口点配置：

• 在ports块中添加"9443:9443"，将宿主机9443端口映射到容器内同端口
• 在command块中添加两个参数：
  • --entrypoints.portainer.address=:9443：定义名为portainer的独立入口点
  • --entrypoints.portainer.http.tls=true：强制该入口点使用HTTPS（也可复用现有Let's Encrypt证书解析器）

2. 修改Portainer的Traefik路由配置 #

调整Portainer服务的标签，将路由切换到新入口点：

• 将traefik.http.routers.portainer.entrypoints=websecure替换为traefik.http.routers.portainer.entrypoints=portainer
• 保留traefik.http.routers.portainer.tls.certresolver=letsencryptresolver可继续自动签发SSL证书

3. 防火墙配置 #

在宿主机防火墙添加规则，仅允许你的IP访问9443端口（以ufw为例）：

ufw allow from 你的IP地址 to any port 9443
ufw reload

修改后的完整docker-compose.yml #

version: "3"

services:
  proxy:
    image: traefik:v3.0
    container_name: "traefik"
    networks:
      - traefik
    ports:
      - "80:80" # HTTP
      - "443:443" # HTTPS
      - "9443:9443" # Portainer专属端口
    volumes:
      - ./letsencrypt:/letsencrypt
      - ./users.u:/users/users.u
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: always
    command:
      #- "--log.level=DEBUG"
      # Docker configuration
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik"
      # Configure entrypoint
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.portainer.address=:9443" # 添加Portainer专属入口点
      - "--entrypoints.portainer.http.tls=true" # 强制HTTPS访问
      # SSL configuration
      - "--certificatesresolvers.letsencryptresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencryptresolver.acme.httpchallenge.entrypoint=web"
      #- "--certificatesresolvers.letsencryptresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.letsencryptresolver.acme.email=none@none.com"
      - "--certificatesresolvers.letsencryptresolver.acme.storage=/letsencrypt/acme.json"
      # Global HTTP -> HTTPS
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      # Enable dashboard
      - "--api.dashboard=true"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencryptresolver"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.usersfile=/users/users.u"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.mydomain.se`)"
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
  
  portainer:
    image: portainer/portainer-ce
    container_name: "portainer"
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
      - "traefik.http.routers.portainer.rule=Host(`portainer.mydomain.se`)"
      - "traefik.http.routers.portainer.entrypoints=portainer" # 切换到专属入口点
      - "traefik.http.routers.portainer.tls.certresolver=letsencryptresolver" # 保留自动证书签发
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /mnt/Storage1/docker-data/portainer:/data
    restart: always

networks:
  traefik:
    external:
      name: traefik

验证方法 #

1. 重启容器：docker-compose up -d
2. 访问Portainer：使用https://portainer.mydomain.se:9443或https://你的服务器IP:9443
3. 检查其他服务：确认它们仍能通过80/443端口正常访问
4. 测试防火墙：用非授权IP尝试访问9443端口，确认被拦截

内容的提问来源于stack exchange，提问作者JensB