MAILCOW target is in position 2 in the ip forward table

ash-development

hi! im getting this error : netfilter-mailcow-1 | MAILCOW target is in position 2 in the ip forward table, restarting container to fix it... when i do sudo iptables -L --line-numbers it shows mailcow on line 2, and when i do sudo iptables -D FORWARD 1 to remove the one overriding it, it simply gets put back

Chain FORWARD (policy DROP)
num  target     prot opt source               destination         
1    DOCKER-USER  all  --  anywhere             anywhere            
2    MAILCOW    all  --  anywhere             anywhere             /* mailcow */

how do i fix this from getting overwritten?

DocFraggle

ash-development when i do sudo iptables -D FORWARD 1 to remove the one overriding it, it simply gets put back

Check your journal, there should be an indication on which service is putting it back. Do yuo have ufd running? If so, try disabling it

esackbauer

I guess you are running on a not supported platform.

ash-development

esackbauer ? this installation has been running for months and just now started doing this. im on ubuntu 22.04 lts

esackbauer

It was a guess, because with so few information about your system we can only guess.

Anything else besides mailcow was installed on that host in the last time?

ash-development

esackbauer do you mean anything new/different installed? if so then no, everything is the same

ash-development

DocFraggle here’s a paste from when i started it to when i stopped - not exactly sure what to look for here https://termbin.com/yvcs0

and do you mean UFW? if so yes - otherwise not sure what you’re talking about!

@[deleted] and sorry for no additional info - there’s a lot of it in my gh issue mailcow/mailcow-dockerized6241

ash-development

im confused because everything i see online is saying that DOCKER-USER is ALWAYS put at #1 in iptables, so why is mailcow asking to be #1? it doesn’t make sense to me 😵‍💫

ash-development

also tried it with a new installation, so its nothing config related :/, also DISABLE_NETFILTER_ISOLATION_RULE=Y does not work

DocFraggle

The docs state that you should NOT use ufw because it is causing problems.

https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports

So please disable it and try again

ash-development

DocFraggle sorry! i meant it was disabled

ash-development

by some miracle it seems the following works - but this is definetely caused by a cached iptables configuration. 100% needs to be looked into by the mailcow team

docker compose down
service docker stop
sudo ip6tables -X
sudo ip6tables -F
sudo ip6tables -X
sudo iptables -F
sudo iptables -X
service docker start
sudo ip6tables -L --line-numbers # just to make sure that the tables are clear
sudo iptables -L --line-numbers # same as above
docker compose up -d

it may take a couple runs for it to work successfully