Synology NAS上Traefik Macvlan域名访问故障排查求助

问题背景 #

• 环境：Synology NAS，80/443端口已被占用，采用macvlan网络部署Traefik
• 路由器端口转发设置：80→8888、443→8443、8080→8080，均指向macvlan分配的IP 192.168.0.240
• 异常现象：
  1. CODE BLOCK 2配置：可通过192.168.0.240:8080和公网IP访问Traefik仪表盘，但自定义域名访问返回404
  2. CODE BLOCK 1配置（非macvlan）：域名可正常访问，无异常
  3. CODE BLOCK 3配置：域名访问报ERR_CONNECTION_REFUSED，IP访问仪表盘也失败

配置问题排查与修复 #

针对CODE BLOCK 2的404问题 #

1. 入口点与路由绑定缺失
   配置中定义了web（8888）和web-secured（8443）入口点，但域名路由api未指定入口点，Traefik无法识别该路由的请求端口。
   • 修复：给api路由添加entrypoints标签，指定web,web-secured，同时补充TLS配置（如需HTTPS访问）
   • 示例修改：

     - "traefik.http.routers.api.entrypoints=web,web-secured"
     - "traefik.http.routers.api.tls=true" # 若需自动证书，需额外配置certResolver
     

2. 仪表盘路由入口点错误
   仪表盘路由dashboard指定的入口点是traefik，但配置中未定义该入口点，导致仅能通过默认8080端口访问。
   • 修复：要么添加traefik入口点定义（指向8080），要么将仪表盘路由的入口点改为web/web-secured，或保留8080直接访问方式。
3. 缺少ACME证书解析器配置
   若域名需HTTPS访问，必须配置certificatesResolvers，否则TLS无法生效，可能导致404或证书错误。可参考CODE BLOCK 1添加证书解析器配置，注意挂载存储目录（/data/acme.json）。

针对CODE BLOCK 3的连接拒绝问题 #

1. 端口映射与macvlan冲突
   配置同时使用mode: host的端口映射和macvlan网络，会导致端口占用冲突：host模式直接占用NAS主机的8888/8443端口，而macvlan容器本身也在使用这些端口，引发连接失败。
   • 修复：删除ports段的host模式映射，macvlan容器已拥有独立IP，无需主机端口映射，路由器直接转发到macvlan的IP和对应端口即可。
2. 入口点定义与端口不匹配
   配置中入口点web指向容器内80端口，但路由器转发的是8888到容器，导致Traefik在容器内80端口监听，外部请求却发到主机8888端口，无法匹配。
   • 修复：要么将入口点web改为:8888（与CODE BLOCK 2一致），要么调整路由器转发规则到容器内的80/443端口（因NAS主机80/443已被占用，推荐前者）。

通用配置优化建议 #

• 统一Traefik版本：CODE BLOCK 1用v2.9，CODE BLOCK 2/3用latest，版本差异可能引发兼容问题，建议固定为v2.9或稳定版。
• 补充日志与访问日志：参考CODE BLOCK 1添加--accesslog=true，便于排查请求流向。
• 验证macvlan网络配置：确认parent: eth0是NAS的正确网卡，macvlan IP192.168.0.240未被局域网其他设备占用。
• 域名解析验证：确保自定义域名已正确解析到公网IP，且路由器端口转发规则生效。

CODE BLOCK 1（非macvlan正常配置） #

version: '3.9'

services:
  traefik:
    image: traefik:v2.9
    ports:
      - published: 8888 # change here to 8080
        target: 80
        protocol: tcp
        mode: host
      - published: 8443 # change here to 8443
        target: 443
        protocol: tcp
        mode: host
      - published: 8080 # change here to 8443
        target: 8080
        protocol: tcp
        mode: host
    networks:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command:
      --providers.docker=true
      --providers.docker.network=proxy
      --providers.docker.exposedByDefault=false
      --entryPoints.web.address=:80
      --entryPoints.web.http.redirections.entryPoint.to=websecure
      --entryPoints.web.http.redirections.entryPoint.scheme=https
      --entryPoints.websecure.address=:443
      --entryPoints.websecure.http.tls=true
      --api.debug=true
      --api.dashboard=true
      --log.level=DEBUG
      --accesslog=true
      --certificatesResolvers.myresolver.acme.email=mail@example.com
      --certificatesResolvers.myresolver.acme.tlschallenge=true
      --certificatesResolvers.myresolver.acme.storage=/acme/acme.json
    labels:
      - traefik.enable=true
      - traefik.http.routers.mydashboard.entrypoints=websecure
      - traefik.http.routers.mydashboard.rule=Host(`traefik.${DOMAIN}`)
      - traefik.http.routers.mydashboard.tls.certresolver=myresolver
      - traefik.http.routers.mydashboard.service=api@internal
      - traefik.http.routers.mydashboard.middlewares=myauth
      - traefik.http.middlewares.myauth.basicauth.users=test:4RmE8IaNYUKBA

  whoami:
    image: traefik/whoami:v1.8
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.entrypoints=websecure
      - traefik.http.routers.mywhoami.rule=Host(`whoami.${DOMAIN}`) || Host(`www.whoami.${DOMAIN}`)
      - traefik.http.routers.mywhoami.tls.certresolver=myresolver
      - traefik.http.services.mywhoami.loadbalancer.server.port=80

networks:
  proxy:
    name: proxy
    attachable: true

CODE BLOCK 2（macvlan配置，域名访问404） #

version: "3.9"

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: always
    environment:
      # - "CF_API_EMAIL=${CF_API_EMAIL}"
      # - "CF_API_KEY=${CF_API_KEY}"
      - "TZ=${TZ}"
    volumes:
      - "/volume1/docker/traefik/data:/data"
      - "/var/run/docker.sock:/var/run/docker.sock"
    command:
      - --api.dashboard=true # <== 启用仪表盘查看服务、中间件、路由等
      - --api.debug=true # <== 启用调试和分析的额外端点
      - --log.level=DEBUG # <== 设置Traefik日志级别
      - --providers.docker=true # <== 启用Docker作为Traefik的服务提供者
      - --providers.docker.exposedbydefault=false # <== 不自动暴露所有容器给Traefik
      # - --providers.file.filename=/dynamic.yaml # <== 引用动态配置文件
      - --providers.docker.network=traefik # <== 在名为traefik的Docker网络上运行
      - --entrypoints.web.address=:8888 # <== 定义名为web的入口点，监听8888端口
      - --entrypoints.web-secured.address=:8443 # <== 定义HTTPS入口点，监听8443端口
    networks:
      - macvlan_network
      - traefik
    labels:
      - "traefik.enable=true" # <== 启用Traefik自身的路由配置
      - "traefik.http.routers.api.rule=Host(`traefik.${DOMAIN}`)" # <== 仪表盘域名规则
      - "traefik.http.routers.api.service=api@internal" # <== 绑定到Traefik内部API服务
      - "traefik.http.routers.dashboard.rule=PathPrefix(/api) || PathPrefix(/dashboard)"
      - "traefik.http.routers.dashboard.entrypoints=traefik"
      - "traefik.http.routers.dashboard.service=api@internal"

networks:
  macvlan_network:
    name: macvlan_network
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: "192.168.0.0/24"
          ip_range: "192.168.0.240/32"
          gateway: "192.168.0.1"
  traefik:
    name: traefik

CODE BLOCK 3（macvlan配置，连接拒绝） #

version: "3.9"

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: always
    ports:
      - published: 8888
        target: 80
        protocol: tcp
        mode: host
      - published: 8443
        target: 443
        protocol: tcp
        mode: host
    environment:
      # - "CF_API_EMAIL=${CF_API_EMAIL}"
      # - "CF_API_KEY=${CF_API_KEY}"
      - "TZ=${TZ}"
    volumes:
      - "/volume1/docker/traefik/data:/data"
      - "/var/run/docker.sock:/var/run/docker.sock"
    command:
      # - --api.insecure=true # <== 启用不安全API，生产环境不推荐
      - --api.dashboard=true # <== 启用仪表盘查看服务、中间件、路由等
      - --api.debug=true # <== 启用调试和分析的额外端点
      - --log.level=DEBUG # <== 设置Traefik日志级别
      - --providers.docker=true # <== 启用Docker作为Traefik的服务提供者
      - --providers.docker.exposedbydefault=false # <== 不自动暴露所有容器给Traefik
      # - --providers.file.filename=/dynamic.yaml # <== 引用动态配置文件
      - --providers.docker.network=traefik # <== 在名为traefik的Docker网络上运行
      - --entrypoints.web.address=:80 # <== 定义名为web的入口点，监听80端口
      - --entrypoints.web-secured.address=:443 # <== 定义HTTPS入口点，监听443端口
    networks:
      - macvlan_network
      - traefik
    labels:
      - "traefik.enable=true" # <== 启用Traefik自身的路由配置
      - "traefik.http.routers.api.rule=Host(`traefik.${DOMAIN}`)" # <== 仪表盘域名规则
      - "traefik.http.routers.api.service=api@internal" # <== 绑定到Traefik内部API服务
      - "traefik.http.routers.dashboard.rule=PathPrefix(/api) || PathPrefix(/dashboard)"
      - "traefik.http.routers.dashboard.entrypoints=traefik"
      - "traefik.http.routers.dashboard.service=api@internal"

networks:
  macvlan_network:
    name: macvlan_network
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: "192.168.0.0/24"
          ip_range: "192.168.0.240/32"
          gateway: "192.168.0.1"
  traefik:
    name: traefik

内容的提问来源于stack exchange，提问作者user2337871