I’m reverse proxying from a cloud-based VPS using NGINX via a VPN to a homeserver running mailcow.
- The NGINX reverse proxy setup in the Mailcow docs works great (I proxy to ports 80/443 at the mailserver though, not alternative ports). I send all traffic via a proxy_pass to the VPN address of my server.
- The TCP streams on the remaining ports also seem to be working for mail and for mail client configuration. Again, I stream all traffic on ports 25 etc via a proxy_pass to the VPN address of my server.
However, RSPAMD isn’t fond of the fact that all the mail coming in has the VPN address of my VPS.
This is the same issue as this forum post I believe. Essentially, you get SPOOF_AUTH and HFILTER_HOSTNAME_UNKNOWN penalties if you do nothing, and IP_REPUTATION_SPAM (though also sometimes this gets cancelled out by a LOCAL_FUZZY_WHITE?) if you add the offending IP address to Forwarding Hosts. In both cases you get SPF violation penalties.
So incoming email->hits my VPS->gets streamed to my Mailcow server with the VPS VPN IP address instead of the client IP address->RSPAMD worries about it and either flat out rejects it, or puts it in spam.
To add a bit of value to my request for help, since I’ve just been lurking here til now and there was no straightforward guide for this setup (although many people asking), I’ll share how I’ve got it working so far.
- I set up Mailcow on a Raspberry Pi, opening all the required ports in the firewall. It’s the only thing, other than the VPN, that the Pi is doing, so I didn’t make any modifications to the setup. The only thing I added was a VPN client. Let’s pretend the VPN address of my Mailcow server is
10.0.0.1.
- I set up the VPN on the VPS (lets say with address
10.0.0.2), then set up the NGINX config on my VPS as described in the docs here with two modifications:
- I set the relevant proxy_pass lines set to
proxy_pass http://10.0.0.1:80...
- I set up the SSL with Certbot, and added those keys in rather than pointing them to Mailcow’s keys (since Mailcow isn’t on this server).
- I opened all the required ports on the VPS. Then I set up TCP streams in nginx.conf for each non-HTTP port to my Mailcow server, and restarted NGINX e.g.:
stream {
server {
listen 25;
proxy_pass 10.0.0.1:25;
}
...
- I went back to the Mailcow server, and disabled the IP verification on the acme-server, changing
SKIP_IP_CHECK=n to y in mailcow.conf, then ran docker compose up -d so that Mailcow could set up its own SSL certificates using the proxy_passed requests from LetsEncrypt.
- I then set up my Amazon SES as an outbound relayhost/smarthost. Plenty of advice for this around, so I won’t document it.
- At this point, everything should work. I could use the UI, and set up my mail clients, send mail (via Amazon SES) and mail was coming in direct to the server via the TCP stream. HOWEVER, RSPAMD was catching all the mail and rejecting it, because the IP address for all mails were set to the VPN IP of the VPS (again, say,
10.0.0.2). So:
- I added the VPS VPN IP to System->Configuration->Options->Forwarding Hosts
Now, RSPAMD isn’t outright rejecting mail, but it still doesn’t like it and typically flags it as spam.
I could raise RSPAMDs thresholds, but I reckon it’d be better to forward the actual client IP through the stream.
I know NGINX can do this, e.g.:
stream {
server {
listen 25;
proxy_pass 10.0.0.1:25;
proxy_protocol on;
}
...
But I can’t work out how to get Mailcow to handle the proxy_protocol. In the Postfix settings, I can see what appears to be some proxy protocol stuff in there so I thought I might just be able to add, you know, something like:
smtp inet n - n - - smtpd
-o proxy_protocol=yes
to an extra.cf file. But I don’t actually know if this is going to work, so if anyone has any ideas about how to proceed, that would be much appreciated. Or if there’s some other way to get this working, I’m open to that too.
Any help much appreciated.
UPDATE: the SPF violation penalties only happen when I send to myself from another server via SES (not using Mailcow)—so I’m not sure if that’s related anymore. I don’t get this with other mails. But I still do get:
IP_REPUTATION_SPAM (4)
RDNS_NONE (2)
UPDATE: the SPF violation penalties only happen when I send to myself from another server via SES (not using Mailcow)—so I’m not sure if that’s related anymore. I don’t get this with other mails. But I still do get:
IP_REPUTATION_SPAM (4)
RDNS_NONE (2)
UPDATE: the SPF violation penalties only happen when I send to myself from another server via SES (not using Mailcow)—so I’m not sure if that’s related anymore. I don’t get this with other mails. But I still do get:
IP_REPUTATION_SPAM (4)
RDNS_NONE (2)
Forgive this repetition. Some issue with submission made me think it wasn’t working.
