How to Configure Windows Sandbox Local Traefik TLS Passthrough via XML in Windows 11

Routing encrypted TLS streams directly to backend application servers without terminating SSL certificates at the edge proxy layer is a vital architectural requirement for zero-trust compliance. Traefik supports native Layer 4 TLS passthrough via SNI inspection. Windows Sandbox on Windows 11 provides a secure, disposable container for validating end-to-end encrypted TLS passthrough workflows safely without touching host network adapters.

Why Test TLS Passthrough in Windows Sandbox

Testing TLS passthrough directly on developer workstations can conflict with existing web servers or certificate stores. Launching Traefik inside an isolated Windows Sandbox enables engineers to test SNI domain routing, end-to-end certificate validation, and TCP connection pooling safely.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikPassthroughSandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikPassLab</HostFolder>
      <SandboxFolder>C:\TraefikPassLab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikPassLab\setup-passthrough.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikPassLabsetup-passthrough.ps1:

Write-Host "Setting up Traefik TLS Passthrough Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

$Config = @"
entryPoints:
  websecure:
    address: ":443"
tcp:
  routers:
    secure-passthrough:
      rule: "HostSNI(`secure.internal.local`)"
      service: "app-backend"
      tls:
        passthrough: true
  services:
    app-backend:
      loadBalancer:
        servers:
          - address: "127.0.0.1:8443"
"@

Set-Content -Path "$Dir	raefik.yml" -Value $Config
Write-Host "Traefik TLS Passthrough Configured for secure.internal.local." -ForegroundColor Green

Testing TLS Passthrough Connections

Launch the sandbox configuration and run OpenSSL s_client tests against port 443 with -servername secure.internal.local. Confirm that the client receives the certificate directly from the backend server at port 8443 without Traefik terminating the session. Closing the sandbox leaves no residual configuration files.