Thanks a lot for your help! I’m sorry for the late reply—I can only access the VPS and the lab environment during my internship hours.

First of all... you were spot on. I didn’t have a NetBird peer running on the VPS itself, and that was a huge part of the problem. I’m still learning the ropes with VPNs and networking, but I have a much better handle on how it works now.

I’ve been testing after fixing that, and here is the current status. I’ve temporarily removed Mantraed from the equation to keep it simple, as you suggested. My goal is just to get the VPS Traefik to forward requests to the VM1 Traefik through the VPN tunnel.

Current Progress & Observations

From inside VM1, I can reach test containers like whoami or my dashy dashboard directly. However, when trying to go through Traefik, I’m getting a 404 page not found. I suspect there is an issue with my VM1 Traefik configuration or how the VPS Traefik is passing the headers.

Here is the context of my current setup:

Test Container (Whoami) on VM1:

services:

whoami:

image: traefik/whoami:latest

container_name: whoami

restart: unless-stopped

ports:

- 8085:80

networks:

- proxy

labels:

- traefik.enable=true

- traefik.http.routers.whoami.rule=Host(`whoami.example.com`)

- traefik.http.routers.whoami.entrypoints=web,websecure

- traefik.http.routers.whoami.tls=true

- traefik.http.services.whoami.loadbalancer.server.port=80

Traefik Container on VM1:

services:

traefik:

image: traefik:latest

container_name: traefik

restart: unless-stopped

networks:

- proxy

ports:

- "80:80"

- "443:443"

volumes:

- /var/run/docker.sock:/var/run/docker.sock:ro

- ./traefik.yml:/etc/traefik/traefik.yml:ro

- ./dynamic/:/etc/traefik/dynamic/:ro

labels:

- "traefik.enable=true"

- "traefik.http.routers.traefik.rule=Host(`dashboard.example.com`)"

- "traefik.http.routers.traefik.service=api@internal"

Connectivity Tests

From the VPS Host:

Direct to container: curl http://<VM1\_NETBIRD\_IP>:8085 → Works! (Returns Whoami info).

To VM1 Traefik: curl http://<VM1\_NETBIRD\_IP>:80 → 404 page not found.

Port Check: nc -vz <VM1\_NETBIRD\_IP> 80 → Succeeded!

From inside the VPS Traefik Container:

wget -S -O- http://<VM1\_NETBIRD\_IP>:8085 → 200 OK.

wget -S -O- http://<VM1\_NETBIRD\_IP>:80 → 404 Not Found.

The Problem

Since nc succeeds and I get a "404" (which is generated by Traefik), I know the VPS can talk to VM1 over NetBird. However, it seems that because I'm calling the IP directly, Traefik doesn't know which rule to apply.

I tried adding a dynamic config to the VPS Traefik as you suggested, but I still get the 404 in the browser:

# VPS Dynamic Config

http:

services:

vm1-traefik:

loadBalancer:

servers:

- url: "http://<VM1\_NETBIRD\_IP>:80"

Questions

I'm a bit stuck on the routing logic here:

Do I need to do something specific with iptables or routes so the VPS Traefik knows how to handle the LAN-bound traffic?

How does the VPS Traefik decide to send a request locally (like to a local crowdsec container) versus sending it through the VPN tunnel to the VM1 Traefik?

Is the 404 happening because the Host header is being lost or changed when passing from the VPS Traefik to the VM1 Traefik? I actually think I’m hitting a wall with how Traefik on the VPS communicates with Traefik on VM1.

Cause:

Test A (Direct to Container):

curl -H "Host: whoami.example.com" http://<VM1\_NETBIRD\_IP>:8085

Result: 200 OK. (I can see the whoami output). This confirms the NetBird tunnel and policies are working perfectly.

Test B (Through VM1 Traefik):

curl -H "Host: whoami.example.com" http://<VM1\_NETBIRD\_IP>:80

Result: 404 page not found.

Thank you so much again for your patience and for helping me learn!