New installation of Mailcow - SMTP not working?

DonZalmrol

ETNyx the floating IP is a static IP with Hetzner, when I change it to another static I have from ISP it’s the same issue. The route to and from is “completely” open in between tunnels. Only on my frontend firewall with Hetzner its set up with NAT rules to allow the needed ports.

When I for example change the destination IP to my other mail server e.g. 192.168.1.100 instead of the Mailcow server 192.168.1.101 it works. My Exchange 2019 server is responding correctly.

Change it back to Mailcow (.101) and it fails.

So I don’t think it’s DNS, believe its on the Debian server itself that hosts my Proxmox :/

chriss

DonZalmrol

When I for example change the destination IP to my other mail server e.g. 192.168.1.100 instead of the Mailcow server 192.168.1.101 it works. My Exchange 2019 server is responding correctly.

Change it back to Mailcow (.101) and it fails.

As a test, what happens if you shut down your regular .100 and bring up the mailcow instance temporarily on ip .100?
(Attempting to rule out mailcow being the problem…)

tracy

If I remember correctly, with Hetzner the SMTP port is not automatically opened on their VPS instances until you have been a user of theirs for at least a month. You have to request it to be opened up before that period.
Have you been a customer of theirs for over 30 days?

DonZalmrol

Been with them since Christmas, SMTP is open and my current mailserver is routed through my main static IP by them 🙂
It’s not an issue with Hetzner, because if change my NAT rule to redirect to my existing spam or mail server, SMTP responds correctly.

When I point it to my Mailcow server, it fails.

update: tested it a bit more.

What works: pointing my NAT rule to the spam server that is also hosted on Hetzner through a private network.
What doesn’t work: pointing my NAT rule to my Exchange or Mailcow server that goes over my wireguard tunnel.

I see the traffic going out without a block, but it’s not coming in…

tracy

DonZalmrol only thing I can think of is if you are double NAT’ing the traffic. In the past I had issue with that.
I’m new to MC-Dockerized… so I myself am still learning it. I’m not personally a big Docker fan.

DocFraggle

Did you add all relevant networks to “AllowedIPs” in your Wireguard config? Also the docker network

DonZalmrol

DocFraggle wireguard should be OK as my current set up is like this

Hetzner pfsense -> Hetzner antispam -> homelab Exchange

And my Exchange works without any issues, same for the haproxy on my firewall to route to the needed web backends.
The mailcow webbackend also works.

What do you mean about docker network?

DocFraggle

DonZalmrol What do you mean about docker network?

Mailcow is running inside the configured Docker network, default is 172.22.1.0/24

DonZalmrol

Did not touched that network, do I need to configure it?
Not seeing anything mentioned in the guides https://docs.mailcow.email/getstarted/prerequisite-system/#outgoing-portshosts

DocFraggle

DonZalmrol Did not touched that network, do I need to configure it?

It may be that you have to allow it in your Wireguard config

esackbauer

I guess the problem is somewhere in the 3 firewalls you have (Hetzner, OpnSense, Proxmox?). Maybe a DNS/hostname based firewall rule?
Try to use the diagnostic tooling in the firewalls, analyse the log files if packets are blocked somewhere.

DonZalmrol

that’s the funny thing, between hetzner and opnsense the wireguard tunnel is fully open.
Proxmox firewall is not used.

I’ll dig in the logs some more.

DonZalmrol

But isn’t that a private network for the docker containers to work in? Anyhow added it for a test and same result.
It’s like smtp comes into hetzner and then disappears in the wireguard tunnel to my homelab.

I see an outgoing log, but no incoming.

DocFraggle

DonZalmrol I see an outgoing log, but no incoming.

I guess you have to debug your Wireguard and routing setup then… can’t really help you further

DonZalmrol

chriss same issue it seems.

Was wrong with the Exchange part, should have been my antispamserver on Hetzner.
Seems something going wrong/on with my wireguard tunnel.

Dvalin21

I’m having issue with smtp as well, allow though my setup is WAY simpler than @DonZalmrol. I’m able to email out and receive email, but when it comes to SMTP I get connection refused. My setup is simple Mailcow, Firewall, Reverse proxy. I thought it was my ISP, but confirmed that all ports are open and I have static IP

DonZalmrol

Now i must say that I haven’t set up the rest yet. Just installed mailcow and a few basic public dns settings and internal access. Then did a test with MXToolbox amd I get the SMTP error.

Does Mailcow allow mxtoolbox smtp testing?