Not able to bind traefik to a single IP address.

[plamer]

Do you want to request a feature or report a bug?

bug

What did you do?

I have a server with two public IPs:

XX.XX.XX.200 - ports 80/443/8080 are free - nothing is listening there
XX.XX.XX.247 - nginx listening on the IP address (not 0.0.0.0)

$ netstat -luntp | grep -Ew "80|443|8080"
tcp        0      0 XX.XX.XX.247:80        0.0.0.0:*               LISTEN      18121/nginx: master
tcp        0      0 XX.XX.XX.247:443       0.0.0.0:*               LISTEN      18121/nginx: master

I'm trying to start traefik only on XX.XX.XX.200 IP:

defaultEntryPoints = ["https","http"]

[entryPoints]
  [entryPoints.http]
  address = "XX.XX.XX.200:80"
  [entryPoints.https]
  address = "XX.XX.XX.200:443"
    [entryPoints.https.tls]

What did you expect to see?

Traefik running on XX.XX.XX.200:80, XX.XX.XX.200:443

What did you see instead?

INFO[2018-10-25T09:24:43+03:00] Preparing server https &{Address::443 TLS:0xc00033a630 Redirect:<nil> Auth:<nil> WhitelistSourceRange:[] WhiteList:<nil> Compress:false ProxyProtocol:<nil> ForwardedHeaders:0xc000333760} with readTimeout=0s writeTimeout=0s idleTimeout=3m0s
FATA[2018-10-25T09:24:44+03:00] Error preparing server: error opening listener: listen tcp :443: bind: address already in use

Output of traefik version: (What version of Traefik are you using?)

Version:      v1.7.3
Codename:     maroilles
Go version:   go1.11.1
Built:        2018-10-15_10:13:00AM
OS/Arch:      linux/amd64

What is your environment & configuration (arguments, toml, provider, platform, ...)?

{
 "LifeCycle": {
  "RequestAcceptGraceTimeout": 0,
  "GraceTimeOut": 0
 },
 "GraceTimeOut": 0,
 "Debug": false,
 "CheckNewVersion": true,
 "SendAnonymousUsage": false,
 "AccessLogsFile": "",
 "AccessLog": null,
 "TraefikLogsFile": "",
 "TraefikLog": null,
 "Tracing": null,
 "LogLevel": "",
 "EntryPoints": {
  "http": {
   "Address": "xxxx",
   "TLS": null,
   "Redirect": null,
   "Auth": null,
   "WhitelistSourceRange": null,
   "WhiteList": null,
   "Compress": false,
   "ProxyProtocol": null,
   "ForwardedHeaders": null
  },
  "https": {
   "Address": "xxxx",
   "TLS": {
    "MinVersion": "",
    "CipherSuites": null,
    "Certificates": null,
    "ClientCAFiles": null,
    "ClientCA": {
     "Files": null,
     "Optional": false
    },
    "DefaultCertificate": null,
    "SniStrict": false
   },
   "Redirect": null,
   "Auth": null,
   "WhitelistSourceRange": null,
   "WhiteList": null,
   "Compress": false,
   "ProxyProtocol": null,
   "ForwardedHeaders": null
  }
 },
 "Cluster": null,
 "Constraints": [],
 "ACME": {
  "Email": "xxxx",
  "Domains": null,
  "Storage": "xxxx",
  "StorageFile": "",
  "OnDemand": false,
  "OnHostRule": false,
  "CAServer": "xxxx",
  "EntryPoint": "xxxx",
  "KeyType": "",
  "DNSChallenge": null,
  "HTTPChallenge": null,
  "TLSChallenge": null,
  "DNSProvider": "",
  "DelayDontCheckDNS": 0,
  "ACMELogging": false,
  "OverrideCertificates": false,
  "TLSConfig": null
 },
 "DefaultEntryPoints": [
  "https",
  "http"
 ],
 "ProvidersThrottleDuration": 2000000000,
 "MaxIdleConnsPerHost": 200,
 "IdleTimeout": 0,
 "InsecureSkipVerify": false,
 "RootCAs": null,
 "Retry": null,
 "HealthCheck": {
  "Interval": 30000000000
 },
 "RespondingTimeouts": null,
 "ForwardingTimeouts": null,
 "AllowMinWeightZero": false,
 "Web": null,
 "Docker": null,
 "File": null,
 "Marathon": null,
 "Consul": null,
 "ConsulCatalog": null,
 "Etcd": {
  "Watch": true,
  "Filename": "",
  "Constraints": [],
  "Trace": false,
  "TemplateVersion": 0,
  "DebugLogGeneratedTemplate": false,
  "Endpoint": "xxxx",
  "Prefix": "/traefik",
  "TLS": null,
  "Username": "",
  "Password": "",
  "UseAPIV3": true
 },
 "Zookeeper": null,
 "Boltdb": null,
 "Kubernetes": null,
 "Mesos": null,
 "Eureka": null,
 "ECS": null,
 "Rancher": null,
 "DynamoDB": null,
 "ServiceFabric": null,
 "Rest": null,
 "API": {
  "EntryPoint": "traefik",
  "Dashboard": true,
  "Debug": false,
  "CurrentConfigurations": null,
  "Statistics": null
 },
 "Metrics": null,
 "Ping": {
  "EntryPoint": "traefik"
 },
 "HostResolver": null,
 "ConfigFile": "/opt/traefik/traefik.toml"
}

[dtomcej]

Hello @plamer,

Looking at the logs you provided:

Preparing server https &{Address::443 TLS:0xc00033a630 Redirect:<nil> Auth:<nil> WhitelistSourceRange:[] WhiteList:<nil> Compress:false ProxyProtocol:<nil> ForwardedHeaders:0xc000333760} with readTimeout=0s writeTimeout=0s idleTimeout=3m0s

That does not match with the configuration you provided:

  [entryPoints.https]
  address = "XX.XX.XX.200:443"
    [entryPoints.https.tls]

The address it is trying to bind to in your logs is all addresses on port 443, which is why you are getting the error.

Can you confirm that you provided the correct toml, and that you are not using any configuration via command line (such as compose arguments)?

Thanks!

[plamer]

Hey @dtomcej, yes, that's correct - I'm starting traefik with only a config file (added the debug flag when creating the issue) as an argument:

[root@bigb traefik]# ls
traefik  traefik.toml
[root@bigb traefik]# ./traefik -c traefik.toml
FATA[2018-10-26T09:03:50+03:00] Error preparing server: error opening listener: listen tcp :80: bind: address already in use
[root@bigb traefik]# grep address traefik.toml
  address = "XX.XX.XX.200:80"
  address = "XX.XX.XX.200:443"

While searching for this I found this issue: #1193 but nothing else.

[dtomcej]

@plamer I have tried to recreate your issue, but with no avail.

I have added 2 IPs to my machine: 10.0.0.100, and 192.168.1.105.

I have created 2 toml files:
test1.toml

defaultEntryPoints = ["http"]

[entryPoints]
  [entryPoints.http]
  address = "10.0.0.100:80"

and
test2.toml

defaultEntryPoints = ["http"]

[entryPoints]
  [entryPoints.http]
  address = "192.168.1.105:80"

When I run:

./traefik -c test1.toml &
./traefik

The first binds to the proper IP, and then the second binds to all available remaining ports:

$ sudo lsof -i -n -P | grep TCP | grep :80 | grep LISTEN
traefik   6124           root    5u  IPv4 0x171888116e7d11e9      0t0    TCP 10.0.0.100:80 (LISTEN)
traefik   6139           root    5u  IPv6 0x17188811852b9ae9      0t0    TCP *:80 (LISTEN)

When I run:

./traefik -c test1.toml &
./traefik -c test2.toml &

They bind to the respective ports:

$ sudo lsof -i -n -P | grep TCP | grep :80 | grep LISTEN
traefik   6124           root    5u  IPv4 0x171888116e7d11e9      0t0    TCP 10.0.0.100:80 (LISTEN)
traefik   6155           root    5u  IPv4 0x17188811721f54e9      0t0    TCP 192.168.1.105:80 (LISTEN)

The only way I get a conflict like you are explaining, is when I run two instances of traefik without the config file at all (both try to bind to all ports 80):

$ sudo ./traefik
FATA[2018-10-29T12:07:57-05:00] Error preparing server: error opening listener: listen tcp :80: bind: address already in use 

Note that the listener address is :80.

The same happens if I duplicate a config:

$ sudo ./traefik -c dist/test3.toml 
FATA[2018-10-29T12:09:09-05:00] Error preparing server: error opening listener: listen tcp 10.0.0.100:80: bind: address already in use

The address attempting to bind is listed in the error message. In your logs your listener is logging as tcp :80. Either your config file has an error, or perhaps a permissions issue is at play.

Are you running the traefik binary? Can you provide the command you are using to run traefik? I feel that something is missing that is causing your conflict.

Thanks!

[plamer]

@dtomcej thanks for testing this - I'm sorry I wasted your time. It appears that if you want to change the listening address you have to clear some (?) key in the etcd store - when I tried running it with a specific address it still started listening on all IPs and after stopping, doing etcdctl del on the traefik prefix and then starting traefik it ran on the specified address in the config.

My apologies again for not trying that in the first place.

[dtomcej]

No worries, I will go ahead and close this ticket then :)

Please feel free to reach out to us on slack if you encounter more issues.
Thanks!