It can happen that your internal services are still reachable from externally, by calling the external IP and setting the Host header manually to sub.mylan.home, even if that were pointing to an internal address. Traefik would only compare the Host header. To secure this you might also add an IP filter for the internal host, but I‘m not sure whether that’d be secure enough.

Very nicely addressed in the Jumper novels by Steven Gould.

100% dirt and water repellant. Just stay clean and dry all the time.

This pic. Just in time for Halloween I guess?