Input output of commands:
`root@post:/etc# iptables -L -vn
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7319 3734K MAILCOW all – * * 0.0.0.0/0 0.0.0.0/0 /* mailcow */
7367 3746K DOCKER-USER all – * * 0.0.0.0/0 0.0.0.0/0
7367 3746K DOCKER-ISOLATION-STAGE-1 all – * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all – * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – docker0 docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – * br-9bc28fa04462 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all – * br-9bc28fa04462 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – br-9bc28fa04462 !br-9bc28fa04462 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – br-9bc28fa04462 br-9bc28fa04462 0.0.0.0/0 0.0.0.0/0
3941 3396K ACCEPT all – * br-mailcow 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
108 6563 DOCKER all – * br-mailcow 0.0.0.0/0 0.0.0.0/0
3318 343K ACCEPT all – br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
66 4351 ACCEPT all – br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – * br-0a12294b198d 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all – * br-0a12294b198d 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – br-0a12294b198d !br-0a12294b198d 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – br-0a12294b198d br-0a12294b198d 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (4 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.199 tcp dpt:25
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.199 tcp dpt:465
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.199 tcp dpt:587
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.8 tcp dpt:80
4 240 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.8 tcp dpt:443
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.12 tcp dpt:8983
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.13 tcp dpt:3306
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.249 tcp dpt:6379
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:110
38 1972 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:143
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:993
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:995
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:4190
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:12345
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all – docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all – br-9bc28fa04462 !br-9bc28fa04462 0.0.0.0/0 0.0.0.0/0
3318 343K DOCKER-ISOLATION-STAGE-2 all – br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all – br-0a12294b198d !br-0a12294b198d 0.0.0.0/0 0.0.0.0/0
7367 3746K RETURN all – * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (4 references)
pkts bytes target prot opt in out source destination
0 0 DROP all – * docker0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all – * br-9bc28fa04462 0.0.0.0/0 0.0.0.0/0
0 0 DROP all – * br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DROP all – * br-0a12294b198d 0.0.0.0/0 0.0.0.0/0
3318 343K RETURN all – * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
7367 3746K RETURN all – * * 0.0.0.0/0 0.0.0.0/0
Chain MAILCOW (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP tcp – !br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0 /* mailcow isolation */
root@post:/etc# ip6tables -L -vn
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MAILCOW all * * ::/0 ::/0 /* mailcow */
0 0 DOCKER-USER all * * ::/0 ::/0
0 0 DOCKER-ISOLATION-STAGE-1 all * * ::/0 ::/0
0 0 ACCEPT all * docker0 ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all * docker0 ::/0 ::/0
0 0 ACCEPT all docker0 !docker0 ::/0 ::/0
0 0 ACCEPT all docker0 docker0 ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain DOCKER (1 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all docker0 !docker0 ::/0 ::/0
0 0 DOCKER-ISOLATION-STAGE-2 all br-9bc28fa04462 !br-9bc28fa04462 ::/0 ::/0
0 0 DOCKER-ISOLATION-STAGE-2 all br-mailcow !br-mailcow ::/0 ::/0
0 0 DOCKER-ISOLATION-STAGE-2 all br-0a12294b198d !br-0a12294b198d ::/0 ::/0
0 0 RETURN all * * ::/0 ::/0
Chain DOCKER-ISOLATION-STAGE-2 (4 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * docker0 ::/0 ::/0
0 0 DROP all * br-9bc28fa04462 ::/0 ::/0
0 0 DROP all * br-mailcow ::/0 ::/0
0 0 DROP all * br-0a12294b198d ::/0 ::/0
0 0 RETURN all * * ::/0 ::/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all * * ::/0 ::/0
Chain MAILCOW (1 references)
pkts bytes target prot opt in out source destination
root@post:/etc# iptables -L -vn -t nat
Chain PREROUTING (policy ACCEPT 2361 packets, 236K bytes)
pkts bytes target prot opt in out source destination
2 104 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
436 22688 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
84 4584 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:445 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
3 156 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1801 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2376 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:4555 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5000 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5984 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5985 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:6379 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:7001 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8090 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8888 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8983 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9200 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9300 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:61616 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 DOCKER all – * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
524 31440 DOCKER all – * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all – * !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE all – * !br-9bc28fa04462 172.18.0.0/16 0.0.0.0/0
1211 92233 MASQUERADE all – * !br-mailcow 172.22.1.0/24 0.0.0.0/0
0 0 MASQUERADE all – * !br-0a12294b198d 172.19.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp – * * 172.22.1.199 172.22.1.199 tcp dpt:25
0 0 MASQUERADE tcp – * * 172.22.1.199 172.22.1.199 tcp dpt:465
0 0 MASQUERADE tcp – * * 172.22.1.199 172.22.1.199 tcp dpt:587
0 0 MASQUERADE tcp – * * 172.22.1.8 172.22.1.8 tcp dpt:80
0 0 MASQUERADE tcp – * * 172.22.1.8 172.22.1.8 tcp dpt:443
0 0 MASQUERADE tcp – * * 172.22.1.12 172.22.1.12 tcp dpt:8983
0 0 MASQUERADE tcp – * * 172.22.1.13 172.22.1.13 tcp dpt:3306
0 0 MASQUERADE tcp – * * 172.22.1.249 172.22.1.249 tcp dpt:6379
0 0 MASQUERADE tcp – * * 172.22.1.250 172.22.1.250 tcp dpt:110
0 0 MASQUERADE tcp – * * 172.22.1.250 172.22.1.250 tcp dpt:143
0 0 MASQUERADE tcp – * * 172.22.1.250 172.22.1.250 tcp dpt:993
0 0 MASQUERADE tcp – * * 172.22.1.250 172.22.1.250 tcp dpt:995
0 0 MASQUERADE tcp – * * 172.22.1.250 172.22.1.250 tcp dpt:4190
0 0 MASQUERADE tcp – * * 172.22.1.250 172.22.1.250 tcp dpt:12345
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all – docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all – br-9bc28fa04462 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all – br-mailcow * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all – br-0a12294b198d * 0.0.0.0/0 0.0.0.0/0
2 120 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:172.22.1.199:25
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 to:172.22.1.199:465
3 180 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 to:172.22.1.199:587
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.22.1.8:80
87 5220 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:172.22.1.8:443
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:18983 to:172.22.1.12:8983
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:13306 to:172.22.1.13:3306
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:7654 to:172.22.1.249:6379
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 to:172.22.1.250:110
473 28080 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 to:172.22.1.250:143
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 to:172.22.1.250:993
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995 to:172.22.1.250:995
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:4190 to:172.22.1.250:4190
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:19991 to:172.22.1.250:12345
root@post:/etc# ip6tables -L -vn -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:25 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:53 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:80 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:110 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:139 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:143 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:443 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:445 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:587 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:1801 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:2376 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:4555 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:5000 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:5984 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:5985 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:6379 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:7001 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:8080 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:8090 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:8888 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:8983 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:9200 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:9300 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:10000 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:61616 mark match ! 0×400/0×400 ADDRTYPE match dst-type LOCAL
0 0 DOCKER all * * ::/0 ::/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all * * ::/0 !::1 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all * !docker0 fd00:dead:beef:c0::/80 ::/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all docker0 * ::/0 ::/0 `