How to Configure Windows Sandbox Local Traefik TLS ALPN via XML in Windows 11

Validating Application-Layer Protocol Negotiation (ALPN) across edge reverse proxies ensures that incoming client connections negotiate the appropriate protocol—such as HTTP/2 (h2), HTTP/1.1 (http/1.1), or custom gRPC streaming protocols—during the TLS handshake. Traefik supports native ALPN matching rules. Windows Sandbox on Windows 11 provides a secure, disposable container for validating ALPN negotiations safely without altering host machine network configurations.

Why Test TLS ALPN in Windows Sandbox

Testing custom ALPN negotiations directly on developer workstations can conflict with existing web servers or system cipher suites. Launching Traefik inside an isolated Windows Sandbox enables engineers to test ALPN protocol matching, client handshake fallbacks, and backend protocol forwarding safely.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikALPNSandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikALPNLab</HostFolder>
      <SandboxFolder>C:\TraefikALPNLab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikALPNLab\setup-alpn.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikALPNLabsetup-alpn.ps1:

Write-Host "Setting up Traefik TLS ALPN Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

$Config = @"
entryPoints:
  websecure:
    address: ":443"
tcp:
  routers:
    alpn-router:
      rule: "ALPN(`h2`, `http/1.1`)"
      service: "http-backend"
      tls:
        passthrough: false
  services:
    http-backend:
      loadBalancer:
        servers:
          - address: "127.0.0.1:8080"
"@

Set-Content -Path "$Dir	raefik.yml" -Value $Config
Write-Host "Traefik TLS Router Configured for ALPN h2 and http/1.1." -ForegroundColor Green

Testing ALPN Negotiations

Launch the sandbox configuration and run OpenSSL s_client tests against port 443 with -alpn h2. Confirm that Traefik successfully negotiates HTTP/2 during the TLS handshake. Closing the sandbox leaves no residual configuration files.