Failed (104: Connection reset by peer) when reverse proxy is outside Docker

Simi83

Has anyone had the same issue? I can’t get Mailcow to work with a reverse proxy outside Docker.
It seems crazy that I can’t use an external reverse proxy to make the service work.
For now, to get mail working, I had to turn off the external reverse proxy and use the one inside Docker.

DocFraggle

Simi83 It seems crazy that I can’t use an external reverse proxy to make the service work.

https://docs.mailcow.email/post_installation/reverse-proxy/r_p/

Have a look here, there are lots of people running the mailcow UI behind a reverse proxy without problems

Simi83

DocFraggle

I’ve followed the official Mailcow documentation exactly, but I’m still having issues getting my external nginx reverse proxy (outside Docker) to communicate properly with Mailcow.

The proxy can resolve the hostnames, but I keep getting connection errors or upstreams marked as “down”, likely due to Docker’s internal networking.

Just because “many people run it without problems” doesn’t mean there aren’t edge cases — like isolated Docker bridges or custom iptables rules — that aren’t fully addressed in the documentation.

If you have a working setup with nginx running outside of Docker, I’d really appreciate it if you could share a real-world configuration, rather than just saying “it works for others.”

esackbauer

Just use the host IP address, in your case 10.0.0.101, and make sure that mailcow.conf has no binding to 127.0.0.1, because localhost is not reachable from outside the host.

I have pretty much the same setup (reverse proxy on different host) and its really that simple.

Simi83

ok thanks, this is my current configuration
do you see any errors?

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

#PROXY NGINX
TRUSTED_PROXIES=10.0.0.101

Redirect HTTP connections to HTTPS - y/n

HTTP_REDIRECT=n

nginx config:
server {
listen 10.0.0.101:80;
server_name webmail.xxxxxxxx mx.xxxxxxxxxxxx autodiscover.xxxxxxxxxxxxxx autoconfig.xxxxxxxxxxxxx;
return 301 https://$host$request_uri;
}

server {
listen 10.0.0.101:443 ssl;
server_name webmail.xxxxxxxx mx.xxxxxxxxxxxx autodiscover.xxxxxxxxxxxxxx autoconfig.xxxxxxxxxxxxx;

client_max_body_size 1G;

ssl_certificate     /mnt/data/certificates/wildcard/cert.pem;
ssl_certificate_key /mnt/data/certificates/wildcard/key.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "geolocation=(), microphone=()" always;
add_header X-XSS-Protection "1; mode=block" always;

location /Microsoft-Server-ActiveSync {
    proxy_pass http://10.0.0.101:8080/Microsoft-Server-ActiveSync;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 75;
    proxy_send_timeout 3650;
    proxy_read_timeout 3650;
    proxy_buffers 64 512k;
    client_body_buffer_size 512k;
    client_max_body_size 0;
}

location / {
    proxy_pass http://10.0.0.101:8080/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffer_size 128k;
    proxy_buffers 64 512k;
    proxy_busy_buffers_size 512k;
    client_max_body_size 0;
}

}

esackbauer

What is this? Where does it come from? Why must I guess?

Simi83

mailcow.conf

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

#PROXY NGINX
TRUSTED_PROXIES=10.0.0.101

Redirect HTTP connections to HTTPS - y/n

HTTP_REDIRECT=n

——————————

Other bindings

——————————

SMTP_PORT=25
SMTPS_PORT=465
SUBMISSION_PORT=587
IMAP_PORT=143
IMAPS_PORT=993
POP_PORT=110
POPS_PORT=995
SIEVE_PORT=4190
DOVEADM_PORT=127.0.0.1:19991
SQL_PORT=127.0.0.1:13306
REDIS_PORT=127.0.0.1:7654

nginx config:

location /Microsoft-Server-ActiveSync {
proxy_pass http://10.0.0.101:8080/Microsoft-Server-ActiveSync;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 75;
proxy_send_timeout 3650;
proxy_read_timeout 3650;
proxy_buffers 64 512k;
client_body_buffer_size 512k;
client_max_body_size 0;
}

location / {
proxy_pass http://10.0.0.101:8080/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffer_size 128k;
proxy_buffers 64 512k;
proxy_busy_buffers_size 512k;
client_max_body_size 0;
}
}

nginx config:

esackbauer

Simi83 #PROXY NGINX
TRUSTED_PROXIES=10.0.0.101

I don’t know where this comes from, but I don’t have this in my mailcow.conf.
And you should paste the configs as code with markdown </>

Nginx config looks ok so far, but do you have any firewalls on your mailcow host (ufw, firewalld)?

Simi83

esackbauer
I’m not using ufw or firewalld, just plain iptables with DROP policies and specific ACCEPT rules.
You can see the firewall rules I’m using earlier in the discussion.

esackbauer

I guess this is your problem then. Mailcow creates its own iptables rules, they might conflict with yours. There is no need for additional rules.
I am not an iptables expert though.

Simi83

Hello everyone,

I solved my Mailcow + external Nginx reverse proxy issues by adding these iptables rules:
iptables -I DOCKER-USER -i br-mailcow -j ACCEPT
iptables -I INPUT -i br-mailcow -j ACCEPT

Here’s my working Nginx config:
server {
listen 10.0.0.101:80;
server_name webmail.xxxxxxxxx.xx mx.xxxxxxxxx.xx autodiscover.xxxxxxxxx.xx autoconfig.xxxxxxxxx.xx;
return 301 https://$host$request_uri;
}

server {
listen 10.0.0.101:443 ssl;
server_name webmail.xxxxxxxxx.xx mx.xxxxxxxxx.xx autodiscover.xxxxxxxxx.xx autoconfig.xxxxxxxxx.xx;
client_max_body_size 1G;

ssl_certificate /mnt/data/certificates/wildcard-xxxxxxxxx.xx/cert.pem;
ssl_certificate_key /mnt/data/certificates/wildcard-xxxxxxxxx.xx/key.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "geolocation=(), microphone=()" always;
add_header X-XSS-Protection "1; mode=block" always;

location /Microsoft-Server-ActiveSync {
    proxy_pass http://MAIL1.xxxxxxxxx.local:8080/Microsoft-Server-ActiveSync;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 75;
    proxy_send_timeout 3650;
    proxy_read_timeout 3650;
    proxy_buffers 64 512k;
    client_body_buffer_size 512k;
    client_max_body_size 0;
}

location / {
    proxy_pass http://MAIL1.xxxxxxxxx.local:8080/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffer_size 128k;
    proxy_buffers 64 512k;
    proxy_busy_buffers_size 512k;
    client_max_body_size 0;
}

}

Relevant mailcow.conf extract:
MAILCOW_HOSTNAME=webmail.xxxxxxxxxxxx.xx
MAILCOW_PASS_SCHEME=BLF-CRYPT

DBNAME=mailcow
DBUSER=mailcow
DBPASS=######################
DBROOT=######################

REDISPASS=######################

TRUSTED_PROXIES=10.0.0.101

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

HTTP_REDIRECT=n

One remaining issue:
When I set HTTP_REDIRECT=y, the webmail becomes completely unreachable.
Any idea why? Thanks in advance.

DocFraggle

Simi83 One remaining issue:
When I set HTTP_REDIRECT=y, the webmail becomes completely unreachable.
Any idea why? Thanks in advance.

I guess that port 8080 gets disabled upon activating the redirect and your reverse proxy therefore can’t reach it’s configured backend anymore

EDIT: btw, you don’t have to set this as your reverse proxy config is taking care of the redirect

Simi83 server {
listen 10.0.0.101:80;
server_name webmail.xxxxxxxxx.xx mx.xxxxxxxxx.xx autodiscover.xxxxxxxxx.xx autoconfig.xxxxxxxxx.xx;
return 301 https://$host$request_uri;
}

Simi83

DocFraggle

Thanks for the suggestion!

I had enabled the redirect in Mailcow’s .env file,
and I also configured the Nginx .conf file like this:

location /Microsoft-Server-ActiveSync {
proxy_pass https://MAIL1.xxxxxxxxxx.local:8443/Microsoft-Server-ActiveSync;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 75;
proxy_send_timeout 3650;
proxy_read_timeout 3650;
proxy_buffers 64 512k;
client_body_buffer_size 512k;
client_max_body_size 0;
}

location / {
proxy_pass https://MAIL1.xxxxxxxxxx.local:8443/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffer_size 128k;
proxy_buffers 64 512k;
proxy_busy_buffers_size 512k;
client_max_body_size 0;
}

Now everything works perfectly!