求助：Traefik置于Apache代理后返回404错误，求配置方案

Hey there, let’s work through this 404 issue together— I’ve configured similar proxy setups with Apache forwarding to Traefik before, so here are the key areas to check:

1. Ensure Apache is Forwarding the Correct Host Header #

Traefik relies heavily on the Host header to route requests to the right Docker Swarm services. If Apache isn’t passing this header through, Traefik won’t know which service to send the request to, resulting in a 404.

Add this to your Apache virtual host configuration for the domain:

ProxyPreserveHost On
ProxyPass / http://<TRAEFIK_VM_IP>:<TRAEFIK_ENTRY_PORT>/
ProxyPassReverse / http://<TRAEFIK_VM_IP>:<TRAEFIK_ENTRY_PORT>/

• Replace <TRAEFIK_VM_IP> with the internal IP of your Traefik VM
• Replace <TRAEFIK_ENTRY_PORT> with the port Traefik is listening on for HTTP (usually 80, but double-check your Traefik config)

After updating, restart Apache with sudo systemctl restart httpd (or apache2 depending on your setup).

2. Verify Traefik’s EntryPoint Configuration #

Make sure Traefik is configured to accept requests from Apache’s IP (or all internal IPs, if that’s safer for your environment). In your Traefik static config (like traefik.yml), check the entrypoint for HTTP:

entryPoints:
  web:
    address: ":80"
    # Optional: Restrict to Apache's IP for security
    # whiteList:
    #   sourceRange:
    #     - <APACHE_SERVER_IP>/32

If you added a whitelist, ensure Apache’s internal IP is included— missing this would block Apache’s requests entirely (though that usually leads to a 403, but it’s worth checking).

3. Confirm Docker Swarm Service Labels Are Still Correct #

Since you migrated your infrastructure, double-check that your Swarm services still have the correct Traefik labels to route requests. For example, a service should have labels like:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.<SERVICE_NAME>.rule=Host(`your-domain.com`)"
  - "traefik.http.routers.<SERVICE_NAME>.entrypoints=web"
  - "traefik.http.services.<SERVICE_NAME>.loadbalancer.server.port=<SERVICE_PORT>"

The critical line here is Host(your-domain.com)— this must match the domain users are accessing (and the Host header Apache is forwarding). If this label is missing or incorrect, Traefik won’t match the request to any service, hence the 404.

4. Test Direct Access to Traefik to Rule Out Network Issues #

On the Apache server (or another internal machine), run a curl command to test if Traefik responds correctly when you send the right Host header:

curl -H "Host: your-domain.com" http://<TRAEFIK_VM_IP>:<TRAEFIK_ENTRY_PORT>

If this returns the expected content, the problem is definitely with Apache’s configuration. If it still returns a 404, then Traefik itself isn’t matching the request to a service— go back to checking your service labels and Traefik’s router rules.

5. Check CentOS Firewall Rules #

CentOS uses firewalld by default— make sure the Traefik VM allows incoming traffic on its entrypoint port from the Apache server’s IP. Run these commands on the Traefik VM:

# Allow traffic from Apache's IP to Traefik's port
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="<APACHE_SERVER_IP>" port port="<TRAEFIK_ENTRY_PORT>" protocol="tcp" accept' --permanent
# Reload firewall to apply changes
sudo firewall-cmd --reload

If you skip this, the firewall might be blocking Apache’s requests to Traefik.

Start with these steps— most of the time, the 404 comes from missing ProxyPreserveHost On in Apache or a misconfigured Host rule in Traefik’s service labels. Let me know if any of these steps resolve your issue, or if you need to dive deeper!

内容的提问来源于stack exchange，提问作者Nándor Holozsnyák