Question: I am trying to connect to a remote SQL Server from my Spring Boot App.

I have the login credentials inside application.properties

```
spring.datasource.url=jdbc:sqlserver://XXXXXXXXX;databaseName=ABC;integratedSecurity=false
spring.datasource.username=user
spring.datasoruce.password=pass
spring.datasource.driver-class-name=com.microsoft.sqlserver.jdbc.SQLServerDriver

```

It gives the error:

```
com.microsoft.sqlserver.jdbc.SQLServerException: Login failed for user 'user'. ClientConnectionId:212427fc-5a34-4b59-944a-cdd3856116e5
    at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:216) ~[sqljdbc4-4.0.jar:na]
    at com.microsoft.sqlserver.jdbc.TDSTokenHandler.onEOF(tdsparser.java:254) ~[sqljdbc4-4.0.jar:na]
    ....

```

But if I try to connect from SQL Server Management using the exact same login credentials(SQL Server Authentication) it works perfectly.

It even works with pymssql. My python code is

```
import pymssql
conn = pymssql.connect(host="XXXXXXXXX", user="user", password="pass", database="ABC")

```

I ran a couple of SELECT statements in python and they worked fine.

I don't understand why I am unable to connect through Java.

Any help is appreciated. Thanks.

Answer: 
The traefik port should be the http port of the container, not the published port on the host. It communicates over the docker network, so publishing the port is unnecessary and against the goals of only having a single port published with a reverse proxy to access all the containers.

In short, you need:

```
traefik.port=80

```

---

Since this question has gotten lots of views, the other reason lots of people see a 502 from traefik is placing the containers on a different docker network from the traefik instance, or having a container on multiple networks and not telling traefik which network to use. This doesn't apply in your case since you have the following lines in your compose file that match up with the traefik service's network:

```
services:
  dokuwiki:
    networks:
      - traefik-network
    labels:
      - traefik.docker.network=traefik-network
networks:
  traefik-network:
    external : true

```

Even if you only assign a service to a single network, some actions like publishing a port will result in your service being attached to two different networks (the ingress network being the second). The network name in the label needs to be the external name, which in your case is the same, but for others that do not specify their network as external, it may have a project or stack name prefixed which you can see in the `docker network ls` output.
Verify Apply:

```
firewall-cmd --add-masquerade --permanent

```

FROM: <https://www.reddit.com/r/linuxadmin/comments/7iom6e/what_does_firewallcmd_addmasquerade_do/>

> 
> Masquerading is a fancy term for Source NAT.
> 
> 
> firewall-cmd in this instance will be adding an iptables rule,
> specifically to the POSTROUTING chain in the nat table.
> 
> 
> You can see what it has actually done by running iptables -t nat -nvL
> POSTROUTING. A typical command to manually create a masquerading rule
> would be iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE, which
> translates to "For packets leaving interface eth0 after they have been
> routed, change their source address to the interface address of eth0".
> 
> 
> This automatically adds a connection tracking entry so that packets
> for connections that are masqueraded in this way have their original
> address and port information reinstated as they return back through
> the system.
> 
> 
> None of this makes your Linux system into a router; that is separate
> behaviour which is enabled (for IPv4) either by doing sysctl -w
> net.ipv4.ip\_forward=1 or echo 1 > /proc/sys/net/ipv4/ip\_forward.
> 
> 
> Routing simply means that the system will dumbly traffic it receives
> according to the destination of that traffic; the iptables NAT stuff
> allows you to alter the packets which are emitted after that routing
> takes place.
> 
> 
> This is a really simple overview and there is a lot more complexity
> and possibilities available by configuring it in different ways.
> 
> 
>