New installation of Mailcow - SMTP not working?

DonZalmrol

Hi all,

TLDR: Mailcow SMTP seems to not be accessible?

I’ve tested Mailcow a while ago but stopped when the LDAP wasn’t implemented yet, now I’ve set up a new VM with Debian 12 fully up to date and no firewall configured.

I have an existing mailserver and spamserver that I wish to replace with Mailcow, these are currently working in healthy state.

Followed the steps from the Mailcow guide and set up my domain: https://docs.mailcow.email/getstarted/install/#initialize-mailcow

When I try to check with MXToolbox my SMTP communication it keeps failing..

How my connection is routed?

Hetzner Pfsense firewall with floating IP and natting configured -> wireguard tunnel to my home Opnsense firewall -> Proxmox homelab server -> virtual machine Debian 12 with Docker

When I try a telnet to port 25 internally I get the following message:
220-FQDN-HERE ESMTP Postcow

But then the connection swiftly closes

All containers are running healthy and ports are open:

ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'
LISTEN 0      4096         0.0.0.0:587        0.0.0.0:*    users:(("docker-proxy",pid=52159,fd=7))
LISTEN 0      4096         0.0.0.0:993        0.0.0.0:*    users:(("docker-proxy",pid=51553,fd=7))
LISTEN 0      4096         0.0.0.0:995        0.0.0.0:*    users:(("docker-proxy",pid=51572,fd=7))
LISTEN 0      4096         0.0.0.0:25         0.0.0.0:*    users:(("docker-proxy",pid=52127,fd=7))
LISTEN 0      4096         0.0.0.0:110        0.0.0.0:*    users:(("docker-proxy",pid=51520,fd=7))
LISTEN 0      4096         0.0.0.0:80         0.0.0.0:*    users:(("docker-proxy",pid=52417,fd=7))
LISTEN 0      4096         0.0.0.0:143        0.0.0.0:*    users:(("docker-proxy",pid=51533,fd=7))
LISTEN 0      4096         0.0.0.0:443        0.0.0.0:*    users:(("docker-proxy",pid=52432,fd=7))
LISTEN 0      4096         0.0.0.0:465        0.0.0.0:*    users:(("docker-proxy",pid=52142,fd=7))
LISTEN 0      4096         0.0.0.0:4190       0.0.0.0:*    users:(("docker-proxy",pid=51588,fd=7))
LISTEN 0      4096            [::]:587           [::]:*    users:(("docker-proxy",pid=52167,fd=7))
LISTEN 0      4096            [::]:993           [::]:*    users:(("docker-proxy",pid=51562,fd=7))
LISTEN 0      4096            [::]:995           [::]:*    users:(("docker-proxy",pid=51581,fd=7))
LISTEN 0      4096            [::]:25            [::]:*    users:(("docker-proxy",pid=52133,fd=7))
LISTEN 0      4096            [::]:110           [::]:*    users:(("docker-proxy",pid=51526,fd=7))
LISTEN 0      4096            [::]:80            [::]:*    users:(("docker-proxy",pid=52424,fd=7))
LISTEN 0      4096            [::]:143           [::]:*    users:(("docker-proxy",pid=51544,fd=7))
LISTEN 0      4096            [::]:443           [::]:*    users:(("docker-proxy",pid=52441,fd=7))
LISTEN 0      4096            [::]:465           [::]:*    users:(("docker-proxy",pid=52150,fd=7))
LISTEN 0      4096            [::]:4190          [::]:*    users:(("docker-proxy",pid=51600,fd=7))

Probably I’m overlooking something silly, but can’t seem to find it.

Thanks in advance

ETNyx

1) You have half-dozen stops on the way from internet to your MC, one of them could be blocking your communication.
2) You mention that on the edge of your network you have floating IP,.. I would suggest to ask for static, if you set up your DNS and ask MXToolbox using FDQN and your IP has changed in mean while, no wonder you can not knock on your own server,…

DonZalmrol

ETNyx the floating IP is a static IP with Hetzner, when I change it to another static I have from ISP it’s the same issue. The route to and from is “completely” open in between tunnels. Only on my frontend firewall with Hetzner its set up with NAT rules to allow the needed ports.

When I for example change the destination IP to my other mail server e.g. 192.168.1.100 instead of the Mailcow server 192.168.1.101 it works. My Exchange 2019 server is responding correctly.

Change it back to Mailcow (.101) and it fails.

So I don’t think it’s DNS, believe its on the Debian server itself that hosts my Proxmox :/

chriss

DonZalmrol

When I for example change the destination IP to my other mail server e.g. 192.168.1.100 instead of the Mailcow server 192.168.1.101 it works. My Exchange 2019 server is responding correctly.

Change it back to Mailcow (.101) and it fails.

As a test, what happens if you shut down your regular .100 and bring up the mailcow instance temporarily on ip .100?
(Attempting to rule out mailcow being the problem…)

tracy

If I remember correctly, with Hetzner the SMTP port is not automatically opened on their VPS instances until you have been a user of theirs for at least a month. You have to request it to be opened up before that period.
Have you been a customer of theirs for over 30 days?

DonZalmrol

Been with them since Christmas, SMTP is open and my current mailserver is routed through my main static IP by them 🙂
It’s not an issue with Hetzner, because if change my NAT rule to redirect to my existing spam or mail server, SMTP responds correctly.

When I point it to my Mailcow server, it fails.

update: tested it a bit more.

What works: pointing my NAT rule to the spam server that is also hosted on Hetzner through a private network.
What doesn’t work: pointing my NAT rule to my Exchange or Mailcow server that goes over my wireguard tunnel.

I see the traffic going out without a block, but it’s not coming in…

tracy

DonZalmrol only thing I can think of is if you are double NAT’ing the traffic. In the past I had issue with that.
I’m new to MC-Dockerized… so I myself am still learning it. I’m not personally a big Docker fan.

DocFraggle

Did you add all relevant networks to “AllowedIPs” in your Wireguard config? Also the docker network

DonZalmrol

DocFraggle wireguard should be OK as my current set up is like this

Hetzner pfsense -> Hetzner antispam -> homelab Exchange

And my Exchange works without any issues, same for the haproxy on my firewall to route to the needed web backends.
The mailcow webbackend also works.

What do you mean about docker network?

DocFraggle

DonZalmrol What do you mean about docker network?

Mailcow is running inside the configured Docker network, default is 172.22.1.0/24

DonZalmrol

Did not touched that network, do I need to configure it?
Not seeing anything mentioned in the guides https://docs.mailcow.email/getstarted/prerequisite-system/#outgoing-portshosts

DocFraggle

DonZalmrol Did not touched that network, do I need to configure it?

It may be that you have to allow it in your Wireguard config

esackbauer

I guess the problem is somewhere in the 3 firewalls you have (Hetzner, OpnSense, Proxmox?). Maybe a DNS/hostname based firewall rule?
Try to use the diagnostic tooling in the firewalls, analyse the log files if packets are blocked somewhere.

DonZalmrol

that’s the funny thing, between hetzner and opnsense the wireguard tunnel is fully open.
Proxmox firewall is not used.

I’ll dig in the logs some more.

DonZalmrol

But isn’t that a private network for the docker containers to work in? Anyhow added it for a test and same result.
It’s like smtp comes into hetzner and then disappears in the wireguard tunnel to my homelab.

I see an outgoing log, but no incoming.

DocFraggle

DonZalmrol I see an outgoing log, but no incoming.

I guess you have to debug your Wireguard and routing setup then… can’t really help you further

DonZalmrol

chriss same issue it seems.

Was wrong with the Exchange part, should have been my antispamserver on Hetzner.
Seems something going wrong/on with my wireguard tunnel.

Dvalin21

I’m having issue with smtp as well, allow though my setup is WAY simpler than @DonZalmrol. I’m able to email out and receive email, but when it comes to SMTP I get connection refused. My setup is simple Mailcow, Firewall, Reverse proxy. I thought it was my ISP, but confirmed that all ports are open and I have static IP

DonZalmrol

Now i must say that I haven’t set up the rest yet. Just installed mailcow and a few basic public dns settings and internal access. Then did a test with MXToolbox amd I get the SMTP error.

Does Mailcow allow mxtoolbox smtp testing?