Can only use localhost or 127.0.0.1 for admin page

maybl8

When I try to use www.mydomain.com The page errors out with the following message:

RR_CONNECTION_REFUSED
Check your Internet connection
Check any cables and reboot any routers, modems, or other network devices you may be using.
Allow Vivaldi to access the network in your firewall or antivirus settings.
If it is already listed as a program allowed to access the network, try removing it from the list and adding it again.
If you use a proxy server…
Check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don't believe you should be using a proxy server: Go to the Vivaldi menu > Settings > Show advanced settings… > Change proxy settings… and make sure your configuration is set to "no proxy" or "direct."

I don’t know what changed. I didn’t do any updates or anything that I am aware of.
Obviously something changed but I don’t know what.

esackbauer

Could you please explain your setup? Reverse proxy?
Is www.mydomain.com pointing to the correct IP?
Is mail.mydomain.com still working?
What do the logs say? Is there a firewall in front of mailcow?
Is www.mydomain.com running on the same nginx as mailcow (which I would never do, to avoid such problems)?

maybl8

First it was working fine. The only thing I have done is started using ipsets. But I don’t think that has anything to do with it.
I don’t use a reverse proxy.
I am getting mail to my server and am able to send mail just fine. So the ip is correct.

[demo@mail ~]$ dig mail.dccathome.com

; <<>> DiG 9.18.27 <<>> mail.dccathome.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3936
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mail.dccathome.com.		IN	A

;; ANSWER SECTION:
mail.dccathome.com.	300	IN	A	47.200.55.89

;; Query time: 76 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Fri Jun 21 07:45:23 EDT 2024
;; MSG SIZE  rcvd: 63

What logs do you want info from?
No firewall just a home router setup. I use a TPLink Deco mesh system. All is working fine there.
I only use the container on this server so I don’t even have nginx installed on the server outside of the container.
I hope this answers your questions.
Thanks for the help.

esackbauer

Again: Where is www.mydomain.com pointing to?

And are you accessing it from outside or inside your home network?

maybl8 No firewall just a home router setup.

A home router is a firewall, typically.
When accessing from the inside you might need reflexive (NAT) rules.

maybl8

[demo@mail ~]$ ping www.dccathome.com
PING www.dccathome.com (47.200.55.89) 56(84) bytes of data.

That is my ip address here.
Sever local ip address is 192.168.68.21
and port 80 http and port 443 https route to that ip according to my router info.

I am going to restart my router and see if I still have the issue.
That didn’t solve it.

piperino

maybl8
you haven’t answered @esackbauer question.
“And are you accessing it from outside or inside your home network?”

If you try from outside port 80 and 443 seems to be closed.

telnet 47.200.55.89 443
Trying 47.200.55.89...
telnet: Unable to connect to remote host: Connection refused

esackbauer

piperino If you try from outside port 80 and 443 seems to be closed.

I guess because he implemented some geoblocking rules, which is also not officially supported…
Maybe this is the cause here.

piperino

esackbauer
don’t think geofencing is the root cause since 25 587 etc. is open, except something weird is done with iptables or ipset.

maybl8

Here is what my iptables.rules is showing

# Generated by iptables-save v1.8.10 on Fri Jun 21 07:58:02 2024
*security
:INPUT ACCEPT [179:47176]
:FORWARD ACCEPT [1190:291968]
:OUTPUT ACCEPT [147:25741]
COMMIT
# Completed on Fri Jun 21 07:58:02 2024
# Generated by iptables-save v1.8.10 on Fri Jun 21 07:58:02 2024
*raw
:PREROUTING ACCEPT [1369:339144]
:OUTPUT ACCEPT [147:25741]
COMMIT
# Completed on Fri Jun 21 07:58:02 2024
# Generated by iptables-save v1.8.10 on Fri Jun 21 07:58:02 2024
*mangle
:PREROUTING ACCEPT [1369:339144]
:INPUT ACCEPT [179:47176]
:FORWARD ACCEPT [1190:291968]
:OUTPUT ACCEPT [147:25741]
:POSTROUTING ACCEPT [1337:317709]
COMMIT
# Completed on Fri Jun 21 07:58:02 2024
# Generated by iptables-save v1.8.10 on Fri Jun 21 07:58:02 2024
*nat
:PREROUTING ACCEPT [114:7886]
:INPUT ACCEPT [4:860]
:OUTPUT ACCEPT [2:390]
:POSTROUTING ACCEPT [88:5653]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.22.1.0/24 ! -o br-mailcow -j MASQUERADE
-A POSTROUTING -s 172.22.1.2/32 -d 172.22.1.2/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.2/32 -d 172.22.1.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.2/32 -d 172.22.1.2/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.6/32 -d 172.22.1.6/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.6/32 -d 172.22.1.6/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.7/32 -d 172.22.1.7/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.9/32 -d 172.22.1.9/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.9/32 -d 172.22.1.9/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.13/32 -d 172.22.1.13/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.3/32 -d 172.22.1.3/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.3/32 -d 172.22.1.3/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.5/32 -d 172.22.1.5/32 -p tcp -m tcp --dport 8983 -j MASQUERADE
-A POSTROUTING -s 172.22.1.8/32 -d 172.22.1.8/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.8/32 -d 172.22.1.8/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.2/32 -d 172.22.1.2/32 -p tcp -m tcp --dport 8983 -j MASQUERADE
-A POSTROUTING -s 172.22.1.11/32 -d 172.22.1.11/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.5/32 -d 172.22.1.5/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.5/32 -d 172.22.1.5/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.10/32 -d 172.22.1.10/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.8/32 -d 172.22.1.8/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.10/32 -d 172.22.1.10/32 -p tcp -m tcp --dport 8983 -j MASQUERADE
-A POSTROUTING -s 172.22.1.12/32 -d 172.22.1.12/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.249/32 -d 172.22.1.249/32 -p tcp -m tcp --dport 6379 -j MASQUERADE
-A POSTROUTING -s 172.22.1.6/32 -d 172.22.1.6/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 12345 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 4190 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 995 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 993 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 143 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 110 -j MASQUERADE
-A POSTROUTING -s 172.22.1.253/32 -d 172.22.1.253/32 -p tcp -m tcp --dport 587 -j MASQUERADE
-A POSTROUTING -s 172.22.1.253/32 -d 172.22.1.253/32 -p tcp -m tcp --dport 465 -j MASQUERADE
-A POSTROUTING -s 172.22.1.253/32 -d 172.22.1.253/32 -p tcp -m tcp --dport 25 -j MASQUERADE
-A POSTROUTING -s 172.22.1.13/32 -d 172.22.1.13/32 -p tcp -m tcp --dport 8983 -j MASQUERADE
-A POSTROUTING -s 172.22.1.4/32 -d 172.22.1.4/32 -p tcp -m tcp --dport 8983 -j MASQUERADE
-A POSTROUTING -s 172.22.1.10/32 -d 172.22.1.10/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.10/32 -d 172.22.1.10/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.22.1.12/32 -d 172.22.1.12/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.22.1.12/32 -d 172.22.1.12/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-mailcow -j RETURN
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 7654 -j DNAT --to-destination 172.22.1.249:6379
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 13306 -j DNAT --to-destination 172.22.1.7:3306
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.22.1.12:443
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.22.1.12:80
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 587 -j DNAT --to-destination 172.22.1.253:587
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 465 -j DNAT --to-destination 172.22.1.253:465
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 25 -j DNAT --to-destination 172.22.1.253:25
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 19991 -j DNAT --to-destination 172.22.1.250:12345
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 4190 -j DNAT --to-destination 172.22.1.250:4190
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 995 -j DNAT --to-destination 172.22.1.250:995
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 993 -j DNAT --to-destination 172.22.1.250:993
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 143 -j DNAT --to-destination 172.22.1.250:143
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 110 -j DNAT --to-destination 172.22.1.250:110
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 18983 -j DNAT --to-destination 172.22.1.13:8983
COMMIT
# Completed on Fri Jun 21 07:58:02 2024
# Generated by iptables-save v1.8.10 on Fri Jun 21 07:58:02 2024
*filter
:INPUT ACCEPT [179:47176]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [147:25741]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:MAILCOW - [0:0]
-A INPUT -m set --match-set myset src -j DROP
-A INPUT -j MAILCOW
-A FORWARD -j MAILCOW
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-mailcow -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-mailcow -j DOCKER
-A FORWARD -i br-mailcow ! -o br-mailcow -j ACCEPT
-A FORWARD -i br-mailcow -o br-mailcow -j ACCEPT
-A DOCKER -d 172.22.1.249/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 6379 -j ACCEPT
-A DOCKER -d 172.22.1.7/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 3306 -j ACCEPT
-A DOCKER -d 172.22.1.12/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.22.1.12/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 587 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 465 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 25 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 12345 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 4190 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 995 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 993 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 143 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 110 -j ACCEPT
-A DOCKER -d 172.22.1.13/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 8983 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-mailcow ! -o br-mailcow -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-mailcow -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
COMMIT
# Completed on Fri Jun 21 07:58:02 2024

This line is the ipset addition.
-A INPUT -m set –match-set myset src -j DROP

piperino

maybl8
please post output of
sudo ipset list
you could try as well
sudo ipset flush
just to check if it makes any difference.

but i still don’t think ipset/iptables are the root cause.

have you check the port-forwarding rule on your internet router and also the firewall on the same.

esackbauer

And if you take this line out?

maybl8

Here is the output:

[demo@mail ~]$ sudo ipset list
[sudo] password for demo:
Name: myset
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xe0d0911c
Size in memory: 1320
References: 1
Number of entries: 19
Members:
1.20.0.0/16
185.190.0.0/16
60.166.0.0/16
24.53.0.0/16
1.28.0.0/16
61.81.0.0/16
68.183.0.0/16
68.82.0.0/16
61.134.0.0/16
68.175.0.0/16
61.85.0.0/16
188.168.0.0/16
61.190.0.0/16
61.51.0.0/16
67.53.0.0/16
60.16.0.0/16
67.60.0.0/16
61.153.0.0/16
82.138.0.0/16

My port forwards are correct the :80 and :443 point to the local server ip.
The firewall and router are the same device.

[root@mail /]# ipset list
Name: myset
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xe0d0911c
Size in memory: 456
References: 1
Number of entries: 0
Members:

ipset flush didn’t make a difference.

piperino

maybl8
ipset looks okay

somewhere traffic is getting blocked.
try to put your mailcow internal IP in some sort of DMZ mode on your router where traffic is directly routed do it with no rules.
-check logs on your router for any blocks and make sure you see traffic on ports 80 and 443
-make sure you don’t have a firewall running on mailcow host.
-do you see traffic from your router in mailcow logs.

this is what nmap shows and most likely nmap doesn’t lie.

Nmap scan report for mail.dccathome.com (47.200.55.89)
Host is up (0.14s latency).
Not shown: 993 filtered ports
PORT     STATE  SERVICE
21/tcp   closed ftp
25/tcp   open   smtp
80/tcp   closed http
443/tcp  closed https
587/tcp  open   submission
993/tcp  open   imaps
4000/tcp open   remoteanything

maybl8

Ok trying to figure out what is blocking it.
I don’t have a DMZ option on my router.

Here is some info:
I will keep trying and post my progress.

[demo@mail ~]$ netstat -na | grep :80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:37548         127.0.0.1:80            ESTABLISHED
tcp        0      0 172.22.1.1:48904        172.22.1.8:80           ESTABLISHED
tcp        0      0 127.0.0.1:80            127.0.0.1:37548         ESTABLISHED
tcp        0      0 192.168.68.21:55176     23.219.155.48:80        ESTABLISHED
tcp6       0      0 :::80                   :::*                    LISTEN

maybl8

I’ve banged my head against the wall all day on this.
I don’t understand and can’t find what is blocking web access to the admin page from the internet or dns.
the only way to get access to the admin page is through localhost.
The sever ip address won’t even work.
I give up.
Here is the latest output from a command I tried.
It appears docker-proxy says it can get to port 80

[root@mail /]# netstat -tnlp | grep -w 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      930898/docker-proxy
tcp6       0      0 :::80                   :::*                    LISTEN      930906/docker-proxy

piperino

maybl8
have you done a:

docker compose down
docker compose up -d

if you’re not using the plugin do docker-compose instead
followed by a reboot

ETNyx

Hi, did you consider that problem is ISP? You wrote about home router, so it’s regular home connection or some commercial one? For start try curl ifconfig.me it should return your IP facing public network.
(Even if I pay for public IP my ISP sometimes rotate it)

maybl8

OK new update on this issue.
Updated mailcow to 2024-06a.
Now without doing anything else ports 80 and 443 are opened.

[demo@mail ~]$ nmap www.dccathome.com
Starting Nmap 7.95 ( https://nmap.org ) at 2024-07-01 07:50 EDT
Nmap scan report for www.dccathome.com (47.205.65.104)
Host is up (0.020s latency).
rDNS record for 47.205.65.104: 47-205-65-104.fdr01.brba.fl.frontiernet.net
Not shown: 944 filtered tcp ports (no-response), 50 closed tcp ports (conn-refused)
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
443/tcp open  https
587/tcp open  submission
993/tcp open  imaps

Nmap done: 1 IP address (1 host up) scanned in 10.87 seconds

What is happening now is the password to admin fails when trying www.dccathome.com.
When using local 127.0.0.1 admin password works.
I’ve manually checked and the I am entering the same password both times.
I am not using a cached or saved password.
Any ideas?