Failed (104: Connection reset by peer) when reverse proxy is outside Docker

Simi83

Hi, I’m running into an issue when trying to use an external Nginx reverse proxy (outside Docker) to access the Mailcow web interface.

When I configure the reverse proxy outside the Docker environment (on the host, pointing to 127.0.0.1:8080), I get repeated Nginx errors like this:

recv() failed (104: Connection reset by peer) while reading response header from upstream
Example Nginx log entries:

2025/06/18 16:02:15 [error] 141448#141448: *82 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 128.116.250.196, server: webmail.arcoiriscreative.es, request: “GET /admin/system HTTP/1.1”, upstream: “http://127.0.0.1:8080/admin/system”
2025/06/18 16:02:42 [error] 141448#141448: *84 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 128.116.250.196, server: webmail.arcoiriscreative.es, request: “GET /favicon.ico HTTP/1.1”, upstream: “http://127.0.0.1:8080/favicon.ico”
However, when I move the reverse proxy into a container (inside Docker), everything works perfectly. The Mailcow web interface loads as expected with no connection issues.

System setup:

Mailcow running in Docker

External Nginx reverse proxy on host (127.0.0.1:8080)

TLS termination on the external proxy

iptables rules allow connections as needed (DROP default policies, with specific ACCEPTs)

Troubleshooting so far:

Verified that the backend is listening and responds correctly

No container crashes or backend errors in Mailcow logs

Only occurs when using a host-based reverse proxy

Expected behavior:
Mailcow should respond correctly to reverse proxy requests from the host (non-Docker) Nginx, just like it does when proxied from within Docker.

Any advice or known limitations regarding this setup?

Thanks!

Logs:
docker logs –tail=50 mailcowdockerized-nginx-mailcow-1
10.213.101.8 - - [18/Jun/2025:16:30:51 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:30:56 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:31:22 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:31:45 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:31:49 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:31:50 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:32:28 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:32:33 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:32:38 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:32:43 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:33:13 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:33:31 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:33:36 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:33:46 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:34:16 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:34:19 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:34:24 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:34:51 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:34:54 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:35:21 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:35:26 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:35:38 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:35:54 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:36:29 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:36:31 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:36:36 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:37:03 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:37:23 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:37:33 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:37:38 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:38:07 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:38:16 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:38:41 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:38:45 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:38:46 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:39:23 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:39:25 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:39:48 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:39:53 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:40:00 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:40:06 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:40:29 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:40:30 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:40:34 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:40:36 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:41:07 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”
10.213.101.8 - - [18/Jun/2025:16:41:21 +0200] “HEAD /settings.php HTTP/1.1” 304 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:41:29 +0200] “HEAD /forwardinghosts.php HTTP/1.1” 200 0 “-” “rspamd-3.11.1”
10.213.101.8 - - [18/Jun/2025:16:41:34 +0200] “GET /forwardinghosts.php HTTP/1.1” 200 27 “-” “rspamd-3.11.1”
10.213.101.12 - - [18/Jun/2025:16:41:48 +0200] “GET / HTTP/1.1” 200 15 “-” “check_http/v (nagios-plugins 2.4.10)”

docker logs –tail=50 mailcowdockerized-php-fpm-mailcow-1
10.213.101.10 - 18/Jun/2025:16:27:16 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:27:54 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:27:59 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:28:02 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:28:38 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:28:43 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:29:00 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:29:44 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:29:49 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:29:49 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:30:46 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:30:51 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:30:56 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:31:45 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:31:49 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:31:50 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:32:33 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:32:38 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:32:43 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:33:13 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:33:31 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:33:36 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:34:16 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:34:19 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:34:24 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:34:54 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:35:21 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:35:26 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:35:38 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:36:29 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:36:31 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:36:36 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:37:23 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:37:33 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:37:38 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:38:07 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:38:41 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:38:45 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:38:46 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:39:23 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:39:48 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:39:53 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:40:00 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:40:29 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:40:34 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:40:36 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:41:21 +0200 “HEAD /settings.php” 304
10.213.101.10 - 18/Jun/2025:16:41:29 +0200 “HEAD /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:41:34 +0200 “GET /forwardinghosts.php” 200
10.213.101.10 - 18/Jun/2025:16:42:10 +0200 “HEAD /settings.php” 304

Steps to reproduce:

Deploy a clean ARM64 virtual machine (tested on Ubuntu 22.04 LTS)
Install Docker and Docker Compose
Clone Mailcow repository and check out the latest 2025-05 tag
Run docker-compose up -d to start Mailcow normally
Ensure nginx-mailcow exposes port 8080 on 127.0.0.1 (host loopback only)
On the host (outside Docker), configure an Nginx reverse proxy with the following:
- Listens on port 443
- Uses proxy_pass http://127.0.0.1:8080
- Proper TLS config (can be self-signed)
Access https://<your-mailcow-domain>/admin/system from a browser
Observe in the host Nginx logs:

recv() failed (104: Connection reset by peer) while reading response header from upstream

Confirm via docker logs:
nginx-mailcow and php-fpm-mailcow show no request received on /admin/system
As a workaround, move the same reverse proxy inside Docker and attach it to the mailcowdockerized_mailcow-network
Now /admin/system works correctly — confirming it’s a network exposure / forwarding issue

Logs of iptables -L -vn:
Chain INPUT (policy DROP)
pkts bytes target prot opt in out source destination
…. ACCEPT all – lo * 0.0.0.0/0 0.0.0.0/0
…. ACCEPT all – IF_EXT * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
…. ACCEPT tcp – IF_EXT * 10.0.0.X 0.0.0.0/0 tcp dpt:22
…. ACCEPT tcp – IF_EXT * PUBLIC_IP_A 0.0.0.0/0 tcp dpt:22
…. ACCEPT tcp – IF_INT * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
…. ACCEPT tcp – IF_INT * 10.0.0.X 0.0.0.0/0 tcp dpt:22
…. ACCEPT tcp – IF_EXT * 0.0.0.0/0 0.0.0.0/0 multiport dports REDIS_PORTS
…. ACCEPT tcp – IF_EXT * 0.0.0.0/0 0.0.0.0/0 multiport dports CUSTOM_APP_PORTS
…. ACCEPT tcp – lo * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
…. ACCEPT tcp – IF_EXT * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
…. ACCEPT tcp – IF_EXT * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
…. ACCEPT tcp – IF_EXT * PUBLIC_IP_A 0.0.0.0/0 tcp dpt:3000
…. ACCEPT tcp – IF_EXT * PUBLIC_IP_B 0.0.0.0/0 tcp dpt:9090
…. ACCEPT tcp – IF_EXT * 0.0.0.0/0 0.0.0.0/0 multiport dports SMTP_PORTS,IMAP_PORTS,SIEVE_PORTS

Chain FORWARD (policy DROP)
pkts bytes target prot opt in out source destination
…. MAILCOW
…. DOCKER-USER
…. DOCKER-FORWARD

Chain OUTPUT (policy ACCEPT)
pkts bytes target prot opt in out source destination
…. ACCEPT all – * lo 0.0.0.0/0 0.0.0.0/0

Chain DOCKER
…. ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 10.213.101.10 tcp dpt:8080
…. ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 10.213.101.253 tcp dpt:465
…. ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 10.213.101.250 tcp dpt:4190
…. DROP all – !br-xxxxxx br-xxxxxx 0.0.0.0/0 0.0.0.0/0
…. DROP all – !docker0 docker0 0.0.0.0/0 0.0.0.0/0

Chain MAILCOW
…. DROP tcp – !br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0 multiport dports MYSQL,REDIS,SOLR,CUSTOM_PORT

Logs of ip6tables -L -vn:
Chain INPUT (policy ACCEPT 40 packets, 3033 bytes)
pkts bytes target prot opt in out source destination
40 3033 MAILCOW 0 – * * ::/0 ::/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MAILCOW 0 – * * ::/0 ::/0
0 0 DOCKER-USER 0 – * * ::/0 ::/0
0 0 DOCKER-FORWARD 0 – * * ::/0 ::/0

Chain OUTPUT (policy ACCEPT 1538 packets, 98865 bytes)
pkts bytes target prot opt in out source destination

Chain DOCKER (0 references)
pkts bytes target prot opt in out source destination

Chain DOCKER-BRIDGE (1 references)
pkts bytes target prot opt in out source destination

Chain DOCKER-CT (1 references)
pkts bytes target prot opt in out source destination

Chain DOCKER-FORWARD (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-CT 0 – * * ::/0 ::/0
0 0 DOCKER-ISOLATION-STAGE-1 0 – * * ::/0 ::/0
0 0 DOCKER-BRIDGE 0 – * * ::/0 ::/0

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination

Chain DOCKER-ISOLATION-STAGE-2 (0 references)
pkts bytes target prot opt in out source destination

Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN 0 – * * ::/0 ::/0

Chain MAILCOW (2 references)
pkts bytes target prot opt in out source destination

Logs of iptables -L -vn -t nat:
Chain PREROUTING (policy ACCEPT)
pkts bytes target prot opt in out source destination
1350 77593 DOCKER all – * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)

Chain OUTPUT (policy ACCEPT)
75 4500 DOCKER all – * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
1841 137K MASQUERADE all – * !br-mailcow 10.213.101.0/24 0.0.0.0/0
0 0 MASQUERADE all – * !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE all – * !br-<other> 172.18.0.0/16 0.0.0.0/0

Chain DOCKER
0 0 RETURN all – br-mailcow * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all – docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all – br-<other> * 0.0.0.0/0 0.0.0.0/0

Port forwarding rules

0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:7654 to:10.213.101.249:6379
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:13306 to:10.213.101.5:3306
4 240 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 to:10.213.101.250:110
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 to:10.213.101.250:143
2 100 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 to:10.213.101.250:993
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995 to:10.213.101.250:995
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:4190 to:10.213.101.250:4190
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 127.0.0.1 tcp dpt:19991 to:10.213.101.250:12345
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:10.213.101.253:25
3 180 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 to:10.213.101.253:465
6 340 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 to:10.213.101.253:587
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:10.213.101.10:8080
0 0 DNAT tcp – !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8443 to:10.213.101.10:8443

Logs of ip6tables -L -vn -t nat:
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER 0 – * * ::/0 ::/0 ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER 0 – * * ::/0 !::1 ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination

DNS check:
root@arm-arcoiriscreative-1:/mnt/data/mailcow-dockerized# docker exec -it mailcowdockerized-acme-mailcow-1 dig +short stackoverflow.com @10.213.101.254
104.18.32.7
172.64.155.249

esackbauer

how should an “external” web proxy connect to a localhost address? delete the 127.0.0.1 from the mailcow bindings. so that mailcow listens on the host IP address.

Simi83

esackbauer

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

location /Microsoft-Server-ActiveSync {
    proxy_pass http://localhost:8080/Microsoft-Server-ActiveSync;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 75;
    proxy_send_timeout 3650;
    proxy_read_timeout 3650;
    proxy_buffers 64 512k;
    client_body_buffer_size 512k;
    client_max_body_size 0;
}

location / {
    proxy_pass http://localhost:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffer_size 128k;
    proxy_buffers 64 512k;
    proxy_busy_buffers_size 512k;
    client_max_body_size 0;
}

}

2025/06/19 11:39:53 [error] 1257#1257: *1159 open() “/usr/share/nginx/html/boaform/admin/formLogin” failed (2: No such file or directory), client: 144.172.XXX.XXX, server: localhost, request: “POST /boaform/admin/formLogin HTTP/1.1”, host: “79.72.XXX.XXX:80”, referrer: “http://79.72.XXX.XXX:80/admin/login.asp”
2025/06/19 11:46:38 [error] 1257#1257: *1163 open() “/usr/share/nginx/html/admin/assets/css/jquery-ui.css” failed (2: No such file or directory), client: 87.255.XXX.XXX, server: localhost, request: “GET /admin/assets/css/jquery-ui.css HTTP/1.0”, host: “79.72.XXX.XXX”
2025/06/19 11:48:07 [error] 1257#1257: *1161 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 128.116.XXX.XXX, server: webmail.arcoiriscreative.es, request: “GET /admin/system HTTP/1.1”, upstream: “http://127.0.0.1:8080/admin/system”, host: “webmail.arcoiriscreative.es”, referrer: “https://webmail.xxxxxx/”
2025/06/19 11:48:07 [error] 1257#1257: *1161 connect() failed (111: Connection refused) while connecting to upstream, client: 128.116.XXX.XXX, server: webmail.xxxxxx, request: “GET /favicon.ico HTTP/1.1”, upstream: “http://127.0.0.1:8080/favicon.ico”, host: “webmail.xxxxxx”
2025/06/19 11:55:12 [error] 1257#1257: *1168 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 128.116.XXX.XXX, server: webmail.xxxxxx, request: “GET /admin/system HTTP/1.1”, upstream: “http://127.0.0.1:8080/admin/system”, host: “webmail.xxxxxx”, referrer: “https://webmail.xxxxxx/”

Simi83

This is the problem:

We have tried several connections to the Mailcow service via the reverse proxy:

http://127.0.0.1:8080 → Local loopback inside the reverse proxy container

http://10.0.0.101:8080 → LAN IP of the host server (bound by nginx-mailcow)

http://10.213.101.6:8080 → Internal Docker IP (via br-mailcow) assigned to the nginx-mailcow container

Simi83

Has anyone had the same issue? I can’t get Mailcow to work with a reverse proxy outside Docker.
It seems crazy that I can’t use an external reverse proxy to make the service work.
For now, to get mail working, I had to turn off the external reverse proxy and use the one inside Docker.

DocFraggle

Simi83 It seems crazy that I can’t use an external reverse proxy to make the service work.

https://docs.mailcow.email/post_installation/reverse-proxy/r_p/

Have a look here, there are lots of people running the mailcow UI behind a reverse proxy without problems

Simi83

DocFraggle

I’ve followed the official Mailcow documentation exactly, but I’m still having issues getting my external nginx reverse proxy (outside Docker) to communicate properly with Mailcow.

The proxy can resolve the hostnames, but I keep getting connection errors or upstreams marked as “down”, likely due to Docker’s internal networking.

Just because “many people run it without problems” doesn’t mean there aren’t edge cases — like isolated Docker bridges or custom iptables rules — that aren’t fully addressed in the documentation.

If you have a working setup with nginx running outside of Docker, I’d really appreciate it if you could share a real-world configuration, rather than just saying “it works for others.”

esackbauer

Just use the host IP address, in your case 10.0.0.101, and make sure that mailcow.conf has no binding to 127.0.0.1, because localhost is not reachable from outside the host.

I have pretty much the same setup (reverse proxy on different host) and its really that simple.

Simi83

ok thanks, this is my current configuration
do you see any errors?

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

#PROXY NGINX
TRUSTED_PROXIES=10.0.0.101

Redirect HTTP connections to HTTPS - y/n

HTTP_REDIRECT=n

nginx config:
server {
listen 10.0.0.101:80;
server_name webmail.xxxxxxxx mx.xxxxxxxxxxxx autodiscover.xxxxxxxxxxxxxx autoconfig.xxxxxxxxxxxxx;
return 301 https://$host$request_uri;
}

server {
listen 10.0.0.101:443 ssl;
server_name webmail.xxxxxxxx mx.xxxxxxxxxxxx autodiscover.xxxxxxxxxxxxxx autoconfig.xxxxxxxxxxxxx;

client_max_body_size 1G;

ssl_certificate     /mnt/data/certificates/wildcard/cert.pem;
ssl_certificate_key /mnt/data/certificates/wildcard/key.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "geolocation=(), microphone=()" always;
add_header X-XSS-Protection "1; mode=block" always;

location /Microsoft-Server-ActiveSync {
    proxy_pass http://10.0.0.101:8080/Microsoft-Server-ActiveSync;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 75;
    proxy_send_timeout 3650;
    proxy_read_timeout 3650;
    proxy_buffers 64 512k;
    client_body_buffer_size 512k;
    client_max_body_size 0;
}

location / {
    proxy_pass http://10.0.0.101:8080/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffer_size 128k;
    proxy_buffers 64 512k;
    proxy_busy_buffers_size 512k;
    client_max_body_size 0;
}

}

esackbauer

What is this? Where does it come from? Why must I guess?

Simi83

mailcow.conf

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

#PROXY NGINX
TRUSTED_PROXIES=10.0.0.101

Redirect HTTP connections to HTTPS - y/n

HTTP_REDIRECT=n

——————————

Other bindings

——————————

SMTP_PORT=25
SMTPS_PORT=465
SUBMISSION_PORT=587
IMAP_PORT=143
IMAPS_PORT=993
POP_PORT=110
POPS_PORT=995
SIEVE_PORT=4190
DOVEADM_PORT=127.0.0.1:19991
SQL_PORT=127.0.0.1:13306
REDIS_PORT=127.0.0.1:7654

nginx config:

location /Microsoft-Server-ActiveSync {
proxy_pass http://10.0.0.101:8080/Microsoft-Server-ActiveSync;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 75;
proxy_send_timeout 3650;
proxy_read_timeout 3650;
proxy_buffers 64 512k;
client_body_buffer_size 512k;
client_max_body_size 0;
}

location / {
proxy_pass http://10.0.0.101:8080/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffer_size 128k;
proxy_buffers 64 512k;
proxy_busy_buffers_size 512k;
client_max_body_size 0;
}
}

nginx config:

esackbauer

Simi83 #PROXY NGINX
TRUSTED_PROXIES=10.0.0.101

I don’t know where this comes from, but I don’t have this in my mailcow.conf.
And you should paste the configs as code with markdown </>

Nginx config looks ok so far, but do you have any firewalls on your mailcow host (ufw, firewalld)?

Simi83

esackbauer
I’m not using ufw or firewalld, just plain iptables with DROP policies and specific ACCEPT rules.
You can see the firewall rules I’m using earlier in the discussion.

esackbauer

I guess this is your problem then. Mailcow creates its own iptables rules, they might conflict with yours. There is no need for additional rules.
I am not an iptables expert though.

Simi83

Hello everyone,

I solved my Mailcow + external Nginx reverse proxy issues by adding these iptables rules:
iptables -I DOCKER-USER -i br-mailcow -j ACCEPT
iptables -I INPUT -i br-mailcow -j ACCEPT

Here’s my working Nginx config:
server {
listen 10.0.0.101:80;
server_name webmail.xxxxxxxxx.xx mx.xxxxxxxxx.xx autodiscover.xxxxxxxxx.xx autoconfig.xxxxxxxxx.xx;
return 301 https://$host$request_uri;
}

server {
listen 10.0.0.101:443 ssl;
server_name webmail.xxxxxxxxx.xx mx.xxxxxxxxx.xx autodiscover.xxxxxxxxx.xx autoconfig.xxxxxxxxx.xx;
client_max_body_size 1G;

ssl_certificate /mnt/data/certificates/wildcard-xxxxxxxxx.xx/cert.pem;
ssl_certificate_key /mnt/data/certificates/wildcard-xxxxxxxxx.xx/key.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "geolocation=(), microphone=()" always;
add_header X-XSS-Protection "1; mode=block" always;

location /Microsoft-Server-ActiveSync {
    proxy_pass http://MAIL1.xxxxxxxxx.local:8080/Microsoft-Server-ActiveSync;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 75;
    proxy_send_timeout 3650;
    proxy_read_timeout 3650;
    proxy_buffers 64 512k;
    client_body_buffer_size 512k;
    client_max_body_size 0;
}

location / {
    proxy_pass http://MAIL1.xxxxxxxxx.local:8080/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffer_size 128k;
    proxy_buffers 64 512k;
    proxy_busy_buffers_size 512k;
    client_max_body_size 0;
}

}

Relevant mailcow.conf extract:
MAILCOW_HOSTNAME=webmail.xxxxxxxxxxxx.xx
MAILCOW_PASS_SCHEME=BLF-CRYPT

DBNAME=mailcow
DBUSER=mailcow
DBPASS=######################
DBROOT=######################

REDISPASS=######################

TRUSTED_PROXIES=10.0.0.101

HTTP_PORT=8080
HTTP_BIND=

HTTPS_PORT=8443
HTTPS_BIND=

HTTP_REDIRECT=n

One remaining issue:
When I set HTTP_REDIRECT=y, the webmail becomes completely unreachable.
Any idea why? Thanks in advance.

DocFraggle

Simi83 One remaining issue:
When I set HTTP_REDIRECT=y, the webmail becomes completely unreachable.
Any idea why? Thanks in advance.

I guess that port 8080 gets disabled upon activating the redirect and your reverse proxy therefore can’t reach it’s configured backend anymore

EDIT: btw, you don’t have to set this as your reverse proxy config is taking care of the redirect

Simi83 server {
listen 10.0.0.101:80;
server_name webmail.xxxxxxxxx.xx mx.xxxxxxxxx.xx autodiscover.xxxxxxxxx.xx autoconfig.xxxxxxxxx.xx;
return 301 https://$host$request_uri;
}

Simi83

DocFraggle

Thanks for the suggestion!

I had enabled the redirect in Mailcow’s .env file,
and I also configured the Nginx .conf file like this:

location /Microsoft-Server-ActiveSync {
proxy_pass https://MAIL1.xxxxxxxxxx.local:8443/Microsoft-Server-ActiveSync;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 75;
proxy_send_timeout 3650;
proxy_read_timeout 3650;
proxy_buffers 64 512k;
client_body_buffer_size 512k;
client_max_body_size 0;
}

location / {
proxy_pass https://MAIL1.xxxxxxxxxx.local:8443/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffer_size 128k;
proxy_buffers 64 512k;
proxy_busy_buffers_size 512k;
client_max_body_size 0;
}

Now everything works perfectly!