Docker Traefik反向代理转发SSH到K3s容器问题求助

同一主机运行K3s集群和Docker Traefik容器，Traefik已完成80/443端口的子域名TLS反向代理，但单个子域名的SSH转发失败。以下是已完成的配置及排查方向：

已完成配置 #

• Ubuntu 22.04 已通过 ufw allow 开放22端口
• Traefik TCP规则配置：

  tcp:
    routers:
      giti-ssh:
        entrypoints:
          - "https"
        rule: "HostSNI(`*`)"
        tls: {}
        service: giti-ssh
    services:
      giti-ssh:
        loadBalancer:
          servers:
            - address: "10.42.0.232:22"
  

• K3s 运行 flannel 和 metallb，外部IP段为10.42.0.0
• 网卡关键信息：

  2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
      link/ether 00:50:56:19:ea:c3 brd ff:ff:ff:ff:ff:ff
      altname enp11s0
      inet "private"/32 metric 100 scope global dynamic ens192
         valid_lft 36147sec preferred_lft 36147sec
      inet 10.42.0.200/32 scope global ens192
         valid_lft forever preferred_lft forever
      inet6 "private"/64 scope link
         valid_lft forever preferred_lft forever
  3: br-5014eb2ffdf2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
      link/ether 02:42:7e:ab:72:98 brd ff:ff:ff:ff:ff:ff
      inet 172.18.0.1/16 brd 172.18.255.255 scope global br-5014eb2ffdf2
         valid_lft forever preferred_lft forever
      inet6 fe80::42:7eff:feab:7298/64 scope link
         valid_lft forever preferred_lft forever
  4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
      link/ether 02:42:a5:03:77:2c brd ff:ff:ff:ff:ff:ff
      inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
         valid_lft forever preferred_lft forever
  7: flannel.1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default
      link/ether 42:1b:d3:49:d3:6b brd ff:ff:ff:ff:ff:ff
      inet 10.42.0.0/32 scope global flannel.1
         valid_lft forever preferred_lft forever
      inet6 fe80::401b:d3ff:fe49:d36b/64 scope link
         valid_lft forever preferred_lft forever
  8: cni0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default qlen 1000
      link/ether e2:27:27:96:96:7e brd ff:ff:ff:ff:ff:ff
      inet 10.42.0.1/24 brd 10.42.0.255 scope global cni0
         valid_lft forever preferred_lft forever
      inet6 fe80::e027:27ff:fe96:967e/64 scope link
         valid_lft forever preferred_lft forever
  

• SSH对应的K3s Service为LoadBalancer类型，监听22端口
• 当前状态：可通过Traefik反向代理的443端口连接容器，但22端口的SSH转发失败，怀疑问题出在Traefik的HostSNI或iptables配置

解决思路 #

1. 调整Traefik入口点配置 #

当前将SSH路由绑定到https入口点（默认443端口），但SSH通常使用22端口：

• 在Traefik静态配置中定义专门的SSH入口点：

  entryPoints:
    https:
      address: ":443"
    ssh:
      address: ":22"
  

• 若要通过443端口转发SSH（SSH over TLS），需客户端使用ssh -p 443连接，同时确保Traefik的TLS配置正确处理TCP流量

2. 修正HostSNI与TLS配置 #

• 纯TCP未加密SSH流量不支持SNI，需去掉tls: {}配置，将路由绑定到22端口入口点：

  tcp:
    routers:
      giti-ssh:
        entrypoints:
          - "ssh"
        rule: "HostSNI(`*`)" # 纯TCP下该规则仅用于匹配所有流量
        service: giti-ssh
    services:
      giti-ssh:
        loadBalancer:
          servers:
            - address: "10.42.0.232:22"
  

• 若使用SSH over TLS，客户端需通过TLS隧道连接，示例命令：

  ssh -o ProxyCommand="openssl s_client -connect %h:443 -servername %h -quiet" user@your-domain.com
  

3. 验证网络连通性 #

• 在Traefik容器内测试访问K3s Service：

  docker exec -it <traefik-container-id> nc -zv 10.42.0.232 22
  

• 检查主机iptables规则，确保流量转发正常：

  iptables -L -n | grep 22
  iptables -t nat -L -n | grep 22
  

• 直接测试K3s Service的可用性：

  nc -zv 10.42.0.232 22
  

4. 确保Docker与K3s网络互通 #

• 检查主机路由表，确认10.42.0.0/24网段路由指向cni0：

  ip route show | grep 10.42.0.0
  

• 若Docker容器无法访问K3s网段，需添加静态路由或调整Docker网络配置，允许跨网段访问

5. 检查UFW规则 #

• 确认UFW允许Docker网桥（172.18.0.0/16）到K3s网段（10.42.0.0/24）的流量：

  ufw status verbose
  

内容的提问来源于stack exchange，提问作者jimmi james