traefik转发给docker中的请求被拒绝

[duskmoon314]

v2ray 4.42.2
traefik 反代
cloudflare cdn

我使用cloudflare作为cdn，防火墙放通url；使用traefik作为代理，将domain/fly的请求转给容器中的core，但被拒绝。相关配置如下：

# docker-compose.yaml
v2fly:
    image: v2fly/v2fly-core:latest
    container_name: v2fly
    ports:
      - "10000:10000"
    networks:
      - traefik-net
    restart: unless-stopped
    depends_on:
      - traefik
    volumes:
      - "./v2fly.config.json:/etc/v2ray/config.json"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.fly.rule=Host(`$DOMAIN_NAME`) && PathPrefix(`/fly`) "

// config.json
{
  "inbounds": [
    {
      "port": 10000,
      "listen": "127.0.0.1",
      "protocol": "vmess",
      "settings": {
        "clients": [
          {
            "id": "db7b7778-48f1-48b7-b115-d6eee3da3c58",
            "alterId": 64
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/fly"
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    }
  ]
}

客户端尝试连接时，无法建立wss连接：

[Warning] [1102033489] app/proxyman/outbound: failed to process outbound traffic > proxy/vmess/outbound: failed to find an available destination > common/retry: [transport/internet/websocket: failed to dial WebSocket > transport/internet/websocket: failed to dial to (wss://domain/fly): 502 Bad Gateway > websocket: bad handshake] > common/retry: all retry attempts failed

查看 cloudflare 已放通，traefik 转发的请求如下（一些信息我删除了）：

{
  "Method": "GET",
  "URL": {
    "Scheme": "",
    "Opaque": "",
    "User": null,
    "Host": "",
    "Path": "/fly",
    "RawPath": "",
    "ForceQuery": false,
    "RawQuery": "",
    "Fragment": "",
    "RawFragment": ""
  },
  "Proto": "HTTP/1.1",
  "ProtoMajor": 1,
  "ProtoMinor": 1,
  "Header": {
    "Accept-Encoding": ["gzip"],
    "Cdn-Loop": ["cloudflare"],
    "Cf-Connecting-Ip": 
    "Cf-Ipcountry": ["CN"],
    "Cf-Ray": 
    "Cf-Visitor": ["{\"scheme\":\"https\"}"],
    "Connection": ["Upgrade"],
    "Sec-Websocket-Key": 
    "Sec-Websocket-Version": ["13"],
    "Upgrade": ["websocket"],
    "User-Agent": ["Go-http-client/1.1"],
    "X-Forwarded-For": 
    "X-Forwarded-Host": 
    "X-Forwarded-Port": ["443"],
    "X-Forwarded-Proto": ["https"],
    "X-Forwarded-Server": 
    "X-Real-Ip": 
  },
  "ContentLength": 0,
  "TransferEncoding": null,
  "Host": 
  "Form": null,
  "PostForm": null,
  "MultipartForm": null,
  "Trailer": null,
  "RemoteAddr": 
  "RequestURI": "/fly",
  "TLS": null
}

结果是

msg="'502 Bad Gateway' caused by: dial tcp 172.28.0.5:10000: connect: connection refused"

输出容器的日志：

V2Ray 4.42.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.17.1 linux/amd64)
A unified platform for anti-censorship.
2021/10/07 02:57:13 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
2021/10/07 02:57:13 [Warning] V2Ray 4.42.2 started