Mailcow relaying spam, even though open relay is disabled

DocFraggle

Are you running a supported OS? I found this GitHub issue regarding Arch Linux which seems to cause this problem as well

mailcow/mailcow-dockerized5242

kolaente

DocFraggle I’ve been running this on the same Debian server since 7 years.

DocFraggle

kolaente I’ve been running this on the same Debian server since 7 years.

So which Debian version is this? 9? And your mailcow, is it up to date?

ETNyx

What docker version are you on?

And those config lines seems to be good

DocFraggle

Also check your “Forwarding Hosts” in the mailcow UI, maybe you added the IPv6 address there accidentially?

kolaente

Docker version:

Client: Docker Engine - Community
 Version:           26.1.4
 API version:       1.45
 Go version:        go1.21.11
 Git commit:        5650f9b
 Built:             Wed Jun  5 11:29:15 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          26.1.4
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.11
  Git commit:       de5c9cf
  Built:            Wed Jun  5 11:29:15 2024
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.6.33
  GitCommit:        d2d58213f83a351ca8f528a95fbd145f5654e957
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

DocFraggle Also check your “Forwarding Hosts” in the mailcow UI, maybe you added the IPv6 address there accidentially?

Is that this config? I don’t have anything configured there.

The IP address is set up in the mailcow.conf, but I guess that was done during the installation?

DocFraggle

kolaente The IP address is set up in the mailcow.conf

Where is it set there? My public IP isn’t in the mailcow.conf file, only the local IPv6 docker network

kolaente

DocFraggle It is set like this:

# Internal IPv6 subnet in fc00::/7
IPV6_NETWORK=fd4d:6169:6c63:6f77::/64

The IP is the one used by the br-mailcow network interface. I assume this is similar to local networks (like 10.0.0.0 or 192.168.0.0)? I can’t remember configuring this explicitly, I assume this was done during the mailcow setup.

[unknown] If I disable ipv6, does that mean other servers won’t be able to talk to my mailcow using ipv6? Or is that separate and should work as long as my server has a public ipv6 address (which it does)?

stefan21

@kolaente

I suppose, you have a static business ipv4.

If your installation/configuration is o.k., you may follow this: https://community.mailcow.email/d/5310-rspamd-error-httpfuzzymailcowemailbad-subject-regextxt/8

Ignore the fuzzy things - just disable ipv6.

Should solve your problem.

DocFraggle

kolaente Yes, ths is just the local IPv6 etwork, not your public IPv6 address. The public IPv6 address is also configured on your host, right? No reverse proxy / NAT stuff or something like this?

kolaente

DocFraggle it is configured on the host (I see it for the eth0 interface when running ip a).

kolaente

DocFraggle It is running on Debian 12, mailcow 2025-07. I guess that’s up to date.

DocFraggle

Ah ok, I thought it’s an older version because you wrote something about 7 years 🙂

But that’s exactly what I’m running, too. Very strange… you could try to check for potential diffs by running

git diff refs/tags/2025-07 data/

in your mailcow-dockerized dir. There will be legit diffs there, but you can check if there’s something else which you may have done in the past

kolaente

DocFraggle It seems like the only modifications are autogenerated config, nothing related to ipv6 or relay functionality:

diff --git a/data/assets/ejabberd/sqlite/sqlite.db b/data/assets/ejabberd/sqlite/sqlite.db
new file mode 100644
index 00000000..981ba6b9
Binary files /dev/null and b/data/assets/ejabberd/sqlite/sqlite.db differ
diff --git a/data/conf/ejabberd/autogen/ejabberd_acl.yml b/data/conf/ejabberd/autogen/ejabberd_acl.yml
new file mode 100644
index 00000000..21db66a4
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_acl.yml
@@ -0,0 +1 @@
+# Autogenerated by mailcow
diff --git a/data/conf/ejabberd/autogen/ejabberd_api.yml b/data/conf/ejabberd/autogen/ejabberd_api.yml
new file mode 100644
index 00000000..58c0ffd7
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_api.yml
@@ -0,0 +1,16 @@
+# Autogenerated by mailcow
+api_permissions:
+  "Reload by mailcow":
+    who:
+      - ip: "172.22.1.0/24"
+    what:
+      - "reload_config"
+      - "restart"
+      - "list_certificates"
+      - "list_cluster"
+      - "join_cluster"
+      - "leave_cluster"
+      - "backup"
+      - "status"
+      - "stats"
+      - "muc_online_rooms"
diff --git a/data/conf/ejabberd/autogen/ejabberd_hosts.yml b/data/conf/ejabberd/autogen/ejabberd_hosts.yml
new file mode 100644
index 00000000..21db66a4
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_hosts.yml
@@ -0,0 +1 @@
+# Autogenerated by mailcow
diff --git a/data/conf/ejabberd/autogen/ejabberd_macros.yml b/data/conf/ejabberd/autogen/ejabberd_macros.yml
new file mode 100644
index 00000000..59bcdf7f
--- /dev/null
+++ b/data/conf/ejabberd/autogen/ejabberd_macros.yml
@@ -0,0 +1,4 @@
+# Autogenerated by mailcow
+define_macro:
+  'MAILCOW_HOSTNAME': "mail.kolaente.de"
+  'EJABBERD_HTTPS': 5443
diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf
index 07065f04..44d33142 100644
--- a/data/conf/postfix/main.cf
+++ b/data/conf/postfix/main.cf
@@ -174,3 +174,35 @@ lmtp_destination_recipient_limit=1

 # DO NOT EDIT ANYTHING BELOW #
 # Overrides #
+
+postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
+  hostkarma.junkemailfilter.com=127.0.0.1*-2
+  list.dnswl.org=127.0.[0..255].0*-2
+  list.dnswl.org=127.0.[0..255].1*-4
+  list.dnswl.org=127.0.[0..255].2*-6
+  list.dnswl.org=127.0.[0..255].3*-8
+  bl.spamcop.net*2
+  bl.suomispam.net*2
+  hostkarma.junkemailfilter.com=127.0.0.2*3
+  hostkarma.junkemailfilter.com=127.0.0.4*2
+  hostkarma.junkemailfilter.com=127.0.1.2*1
+  backscatter.spameatingmonkey.net*2
+  bl.ipv6.spameatingmonkey.net*2
+  bl.spameatingmonkey.net*2
+  b.barracudacentral.org=127.0.0.2*7
+  bl.mailspike.net=127.0.0.2*5
+  bl.mailspike.net=127.0.0.[10;11;12]*4
+  dnsbl.sorbs.net=127.0.0.10*8
+  dnsbl.sorbs.net=127.0.0.5*6
+  dnsbl.sorbs.net=127.0.0.7*3
+  dnsbl.sorbs.net=127.0.0.8*2
+  dnsbl.sorbs.net=127.0.0.6*2
+  dnsbl.sorbs.net=127.0.0.9*2
+  zen.spamhaus.org=127.0.0.[10;11]*8
+  zen.spamhaus.org=127.0.0.[4..7]*6
+  zen.spamhaus.org=127.0.0.3*4
+  zen.spamhaus.org=127.0.0.2*3
+
+# User Overrides
+myhostname = mail.kolaente.de
+
diff --git a/data/conf/sogo/sogo.conf b/data/conf/sogo/sogo.conf
index 2c8d80a1..6fa6834d 100644
--- a/data/conf/sogo/sogo.conf
+++ b/data/conf/sogo/sogo.conf
@@ -5,7 +5,7 @@
         PrivateDAndTViewer
     );

-    WOWorkersCount = "20";
+    WOWorkersCount = "7";
     SOGoACLsSendEMailNotifications = YES;
     SOGoAppointmentSendEMailNotifications = YES;
     SOGoDraftsFolderName = "Drafts";
diff --git a/data/web/.well-known/mta-sts.txt b/data/web/.well-known/mta-sts.txt
new file mode 100644
index 00000000..3ae76dd8
--- /dev/null
+++ b/data/web/.well-known/mta-sts.txt
@@ -0,0 +1,4 @@
+version: STSv1
+mode: enforce
+max_age: 15552000
+mx: mail.kolaente.de

DocFraggle

OK, I’m out of ideas… did you try stopping the stack, rebooting and starting it again?

kolaente

Just upgraded to 2025-09. Since they changed a few things regarding ipv6 in the update, maybe that has fixed it? How can I test this?

DocFraggle

Still the same unfortunately…

# telnet 2a01:4f8:1c1c:56c7::1 25

Trying 2a01:4f8:1c1c:56c7::1...
Connected to 2a01:4f8:1c1c:56c7::1.
Escape character is '^]'.
220 mail.kolaente.de ESMTP Postcow
ehlo test.de
250-mail.kolaente.de
250-PIPELINING
250-SIZE 104857600
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: test@test.de
250 2.1.0 Ok
rcpt to: postmaster@gmail.com
250 2.1.5 Ok
quit
221 2.0.0 Bye
Connection closed by foreign host.

According to my toolbox your VPS is running at Hetzner? Did you check your network config? See:

https://docs.mailcow.email/getstarted/prerequisite-system/#hetzner-cloud-and-probably-others

Mine is running at Hetzner as well and iirc I did this before installing mailcow

kolaente

DocFraggle It seems I’ve done the changes at some point.

I had another idea: Given how docker works, isn’t the ip when it reaches postfix always the ip of the container it came through? That would mean postfix will accept any ip because they all look as if they would come from the same internal container. How can I verify if that’s the case?

But I have no idea if this is how ipv6 works soooo…

DocFraggle

No, port 25 of the postfix container is directly exposed, so there is no other container before that.
And, as I said before, I have exactly the same system you have, even a Hetzner VPS, and I don’t have this problem

Do you mind sharing the exact output of the command

ip a s

of your system and your iptables rules by running

iptables -L -vn
ip6tables -L -vn
iptables -L -vn -t nat
ip6tables -L -vn -t nat

kolaente

DocFraggle Here you go:

$ ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 96:00:00:0f:3b:36 brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    altname ens3
    inet 159.69.89.190/32 brd 159.69.89.190 scope global dynamic eth0
       valid_lft 57390sec preferred_lft 57390sec
    inet6 2a01:4f8:1c1c:56c7::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::9400:ff:fe0f:3b36/64 scope link
       valid_lft forever preferred_lft forever
4: br-bebd53950e1e: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:79:15:57:4b brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.1/16 brd 172.19.255.255 scope global br-bebd53950e1e
       valid_lft forever preferred_lft forever
    inet6 fe80::42:79ff:fe15:574b/64 scope link
       valid_lft forever preferred_lft forever
5: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:c5:54:9e:de brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fd00:dead:beef:c0::1/80 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::42:c5ff:fe54:9ede/64 scope link
       valid_lft forever preferred_lft forever
    inet6 fe80::1/64 scope link
       valid_lft forever preferred_lft forever
9: vethc6787f0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-bebd53950e1e state UP group default
    link/ether c2:1d:82:35:38:14 brd ff:ff:ff:ff:ff:ff link-netnsid 7
    inet6 fe80::c01d:82ff:fe35:3814/64 scope link
       valid_lft forever preferred_lft forever
15: veth83548f0@if14: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-bebd53950e1e state UP group default
    link/ether 5a:40:94:06:ca:fb brd ff:ff:ff:ff:ff:ff link-netnsid 4
    inet6 fe80::5840:94ff:fe06:cafb/64 scope link
       valid_lft forever preferred_lft forever
3380: br-mailcow: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:6f:e1:90:a3 brd ff:ff:ff:ff:ff:ff
    inet 172.22.1.1/24 brd 172.22.1.255 scope global br-mailcow
       valid_lft forever preferred_lft forever
    inet6 fd4d:6169:6c63:6f77::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::42:6fff:fee1:90a3/64 scope link
       valid_lft forever preferred_lft forever
    inet6 fe80::1/64 scope link
       valid_lft forever preferred_lft forever
3382: vethc0bf9aa@if3381: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether ce:b4:8d:6e:36:17 brd ff:ff:ff:ff:ff:ff link-netnsid 5
    inet6 fe80::ccb4:8dff:fe6e:3617/64 scope link
       valid_lft forever preferred_lft forever
3384: veth0c4a666@if3383: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 9e:30:59:66:8e:65 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::9c30:59ff:fe66:8e65/64 scope link
       valid_lft forever preferred_lft forever
3386: veth99094fb@if3385: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether e2:b5:63:19:92:44 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::e0b5:63ff:fe19:9244/64 scope link
       valid_lft forever preferred_lft forever
3388: veth7dac259@if3387: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 5a:c5:4e:7e:93:1c brd ff:ff:ff:ff:ff:ff link-netnsid 8
    inet6 fe80::58c5:4eff:fe7e:931c/64 scope link
       valid_lft forever preferred_lft forever
3390: veth3b0f8d0@if3389: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether f6:8b:a4:bf:a1:9d brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::f48b:a4ff:febf:a19d/64 scope link
       valid_lft forever preferred_lft forever
3392: veth5762ff0@if3391: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether de:35:c6:d8:7a:74 brd ff:ff:ff:ff:ff:ff link-netnsid 6
    inet6 fe80::dc35:c6ff:fed8:7a74/64 scope link
       valid_lft forever preferred_lft forever
3394: veth3f4180e@if3393: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether d2:96:47:38:6b:7b brd ff:ff:ff:ff:ff:ff link-netnsid 9
    inet6 fe80::d096:47ff:fe38:6b7b/64 scope link
       valid_lft forever preferred_lft forever
3396: veth2fde5fc@if3395: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 02:ab:66:96:39:75 brd ff:ff:ff:ff:ff:ff link-netnsid 10
    inet6 fe80::ab:66ff:fe96:3975/64 scope link
       valid_lft forever preferred_lft forever
3398: veth15b1227@if3397: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 36:8b:a2:a1:7e:ca brd ff:ff:ff:ff:ff:ff link-netnsid 11
    inet6 fe80::348b:a2ff:fea1:7eca/64 scope link
       valid_lft forever preferred_lft forever
3400: veth7f36658@if3399: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 4a:a4:5d:ea:43:09 brd ff:ff:ff:ff:ff:ff link-netnsid 12
    inet6 fe80::48a4:5dff:feea:4309/64 scope link
       valid_lft forever preferred_lft forever
3402: vethb46d4ed@if3401: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether d2:d2:85:09:53:81 brd ff:ff:ff:ff:ff:ff link-netnsid 13
    inet6 fe80::d0d2:85ff:fe09:5381/64 scope link
       valid_lft forever preferred_lft forever
3404: veth4731333@if3403: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 26:6a:34:48:81:40 brd ff:ff:ff:ff:ff:ff link-netnsid 15
    inet6 fe80::246a:34ff:fe48:8140/64 scope link
       valid_lft forever preferred_lft forever
3406: veth1f86b8e@if3405: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether e6:65:ff:6a:b8:69 brd ff:ff:ff:ff:ff:ff link-netnsid 14
    inet6 fe80::e465:ffff:fe6a:b869/64 scope link
       valid_lft forever preferred_lft forever
3408: veth4934174@if3407: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether fa:7c:d1:15:7f:3e brd ff:ff:ff:ff:ff:ff link-netnsid 16
    inet6 fe80::f87c:d1ff:fe15:7f3e/64 scope link
       valid_lft forever preferred_lft forever
3410: veth56c604e@if3409: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 06:41:1f:f4:3b:6b brd ff:ff:ff:ff:ff:ff link-netnsid 17
    inet6 fe80::441:1fff:fef4:3b6b/64 scope link
       valid_lft forever preferred_lft forever
3412: veth46fc48f@if3411: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 02:4a:a5:02:86:ce brd ff:ff:ff:ff:ff:ff link-netnsid 19
    inet6 fe80::4a:a5ff:fe02:86ce/64 scope link
       valid_lft forever preferred_lft forever
3414: veth0c4f94e@if3413: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether ba:f4:91:37:74:0e brd ff:ff:ff:ff:ff:ff link-netnsid 20
    inet6 fe80::b8f4:91ff:fe37:740e/64 scope link
       valid_lft forever preferred_lft forever
3416: veth3f17d80@if3415: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-mailcow state UP group default
    link/ether 4a:2a:a7:7b:bb:93 brd ff:ff:ff:ff:ff:ff link-netnsid 21
    inet6 fe80::482a:a7ff:fe7b:bb93/64 scope link
       valid_lft forever preferred_lft forever

$ iptables -L -vn
Chain INPUT (policy ACCEPT 15215 packets, 868K bytes)
 pkts bytes target     prot opt in     out     source               destination
15956 1215K MAILCOW    0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
3586K 2209M DOCKER-USER  0    --  *      *       0.0.0.0/0            0.0.0.0/0
3586K 2209M DOCKER-ISOLATION-STAGE-1  0    --  *      *       0.0.0.0/0            0.0.0.0/0
2277K 1517M ACCEPT     0    --  *      br-mailcow  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 193K   13M DOCKER     0    --  *      br-mailcow  0.0.0.0/0            0.0.0.0/0
 665K  356M ACCEPT     0    --  br-mailcow !br-mailcow  0.0.0.0/0            0.0.0.0/0
 177K   12M ACCEPT     0    --  br-mailcow br-mailcow  0.0.0.0/0            0.0.0.0/0
 452K  322M MAILCOW    0    --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     0    --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     0    --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     0    --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     0    --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
  53M 5935M ACCEPT     0    --  *      br-bebd53950e1e  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
39902 2394K DOCKER     0    --  *      br-bebd53950e1e  0.0.0.0/0            0.0.0.0/0
  41M   61G ACCEPT     0    --  br-bebd53950e1e !br-bebd53950e1e  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     0    --  br-bebd53950e1e br-bebd53950e1e  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 15200 packets, 751K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (3 references)
 pkts bytes target     prot opt in     out     source               destination
39828 2390K ACCEPT     6    --  !br-bebd53950e1e br-bebd53950e1e  0.0.0.0/0            172.19.0.2           tcp dpt:9417
   74  4440 ACCEPT     6    --  !br-bebd53950e1e br-bebd53950e1e  0.0.0.0/0            172.19.0.3           tcp dpt:9100
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.249         tcp dpt:6379
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.6           tcp dpt:3306
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.250         tcp dpt:12345
   18  1012 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.250         tcp dpt:4190
  569 33888 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.250         tcp dpt:995
 3705  223K ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.250         tcp dpt:993
  221 12972 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.250         tcp dpt:143
  159  9316 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.250         tcp dpt:110
 4851  292K ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.12          tcp dpt:443
 4779  283K ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.12          tcp dpt:80
  598 33692 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.253         tcp dpt:587
  351 21016 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.253         tcp dpt:465
  623 36252 ACCEPT     6    --  !br-mailcow br-mailcow  0.0.0.0/0            172.22.1.253         tcp dpt:25

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
 665K  356M DOCKER-ISOLATION-STAGE-2  0    --  br-mailcow !br-mailcow  0.0.0.0/0            0.0.0.0/0
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
  41M   61G DOCKER-ISOLATION-STAGE-2  0    --  br-bebd53950e1e !br-bebd53950e1e  0.0.0.0/0            0.0.0.0/0
1745M  610G RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       0    --  *      br-mailcow  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       0    --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       0    --  *      br-bebd53950e1e  0.0.0.0/0            0.0.0.0/0
 172M  140G RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
1745M  610G RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain MAILCOW (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       6    --  !br-mailcow br-mailcow  0.0.0.0/0            0.0.0.0/0            multiport dports 3306,6379,8983,12345

root@mailcow:/root # ip6tables -L -vn
Chain INPUT (policy ACCEPT 237K packets, 43M bytes)
 pkts bytes target     prot opt in     out     source               destination
 240K   44M MAILCOW    0    --  *      *       ::/0                 ::/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 344K  200M DOCKER-USER  0    --  *      *       ::/0                 ::/0
 344K  200M DOCKER-ISOLATION-STAGE-1  0    --  *      *       ::/0                 ::/0
 237K  191M ACCEPT     0    --  *      br-mailcow  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
61358 4233K DOCKER     0    --  *      br-mailcow  ::/0                 ::/0
45821 5582K ACCEPT     0    --  br-mailcow !br-mailcow  ::/0                 ::/0
61353 4232K ACCEPT     0    --  br-mailcow br-mailcow  ::/0                 ::/0
    0     0 MAILCOW    0    --  *      *       ::/0                 ::/0
    0     0 ACCEPT     0    --  *      docker0  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
    0     0 DOCKER     0    --  *      docker0  ::/0                 ::/0
    0     0 ACCEPT     0    --  docker0 !docker0  ::/0                 ::/0
    0     0 ACCEPT     0    --  docker0 docker0  ::/0                 ::/0

Chain OUTPUT (policy ACCEPT 210K packets, 713M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::d  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::d  tcp dpt:465
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::10  tcp dpt:443
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::e  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::e  tcp dpt:465
    5   384 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::b  tcp dpt:4190
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::b  tcp dpt:995
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::11  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::11  tcp dpt:465

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
45821 5582K DOCKER-ISOLATION-STAGE-2  0    --  br-mailcow !br-mailcow  ::/0                 ::/0
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  ::/0                 ::/0
 190M  111G RETURN     0    --  *      *       ::/0                 ::/0

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       0    --  *      br-mailcow  ::/0                 ::/0
    0     0 DROP       0    --  *      docker0  ::/0                 ::/0
  11M 3215M RETURN     0    --  *      *       ::/0                 ::/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
 191M  112G RETURN     0    --  *      *       ::/0                 ::/0

Chain MAILCOW (2 references)
 pkts bytes target     prot opt in     out     source               destination

$ iptables -L -vn -t nat

Chain PREROUTING (policy ACCEPT 336K packets, 24M bytes)
 pkts bytes target     prot opt in     out     source               destination
  11M  603M DOCKER     0    --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 14223 packets, 728K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 95 packets, 6216 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER     0    --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 192K packets, 13M bytes)
 pkts bytes target     prot opt in     out     source               destination
 147K   11M MASQUERADE  0    --  *      !br-mailcow  172.22.1.0/24        0.0.0.0/0
    0     0 MASQUERADE  0    --  *      !docker0  172.17.0.0/16        0.0.0.0/0
    1    64 MASQUERADE  0    --  *      !br-bebd53950e1e  172.19.0.0/16        0.0.0.0/0
    0     0 MASQUERADE  6    --  *      *       172.19.0.2           172.19.0.2           tcp dpt:9417
    0     0 MASQUERADE  6    --  *      *       172.19.0.3           172.19.0.3           tcp dpt:9100
    0     0 MASQUERADE  6    --  *      *       172.22.1.249         172.22.1.249         tcp dpt:6379
    0     0 MASQUERADE  6    --  *      *       172.22.1.6           172.22.1.6           tcp dpt:3306
    0     0 MASQUERADE  6    --  *      *       172.22.1.250         172.22.1.250         tcp dpt:12345
    0     0 MASQUERADE  6    --  *      *       172.22.1.250         172.22.1.250         tcp dpt:4190
    0     0 MASQUERADE  6    --  *      *       172.22.1.250         172.22.1.250         tcp dpt:995
    0     0 MASQUERADE  6    --  *      *       172.22.1.250         172.22.1.250         tcp dpt:993
    0     0 MASQUERADE  6    --  *      *       172.22.1.250         172.22.1.250         tcp dpt:143
    0     0 MASQUERADE  6    --  *      *       172.22.1.250         172.22.1.250         tcp dpt:110
    0     0 MASQUERADE  6    --  *      *       172.22.1.12          172.22.1.12          tcp dpt:443
    0     0 MASQUERADE  6    --  *      *       172.22.1.12          172.22.1.12          tcp dpt:80
    0     0 MASQUERADE  6    --  *      *       172.22.1.253         172.22.1.253         tcp dpt:587
    0     0 MASQUERADE  6    --  *      *       172.22.1.253         172.22.1.253         tcp dpt:465
    0     0 MASQUERADE  6    --  *      *       172.22.1.253         172.22.1.253         tcp dpt:25

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
   88  5280 RETURN     0    --  br-mailcow *       0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     0    --  docker0 *       0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     0    --  br-bebd53950e1e *       0.0.0.0/0            0.0.0.0/0
39828 2390K DNAT       6    --  !br-bebd53950e1e *       0.0.0.0/0            159.69.89.190        tcp dpt:9417 to:172.19.0.2:9417
   74  4440 DNAT       6    --  !br-bebd53950e1e *       0.0.0.0/0            159.69.89.190        tcp dpt:9100 to:172.19.0.3:9100
    0     0 DNAT       6    --  !br-mailcow *       0.0.0.0/0            127.0.0.1            tcp dpt:7654 to:172.22.1.249:6379
    0     0 DNAT       6    --  !br-mailcow *       0.0.0.0/0            127.0.0.1            tcp dpt:13306 to:172.22.1.6:3306
    0     0 DNAT       6    --  !br-mailcow *       0.0.0.0/0            127.0.0.1            tcp dpt:19991 to:172.22.1.250:12345
   18  1012 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:4190 to:172.22.1.250:4190
  569 33888 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:995 to:172.22.1.250:995
 3707  223K DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:993 to:172.22.1.250:993
  221 12972 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:143 to:172.22.1.250:143
  159  9316 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:110 to:172.22.1.250:110
 4855  292K DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 to:172.22.1.12:443
 4780  283K DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.22.1.12:80
  598 33692 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:587 to:172.22.1.253:587
  351 21016 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:465 to:172.22.1.253:465
  623 36252 DNAT       6    --  !br-mailcow *       0.0.0.0/0            0.0.0.0/0            tcp dpt:25 to:172.22.1.253:25

$ ip6tables -L -vn -t nat
Chain PREROUTING (policy ACCEPT 57612 packets, 5219K bytes)
 pkts bytes target     prot opt in     out     source               destination
6172K  516M DOCKER     0    --  *      *       ::/0                 ::/0                 ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 2415 packets, 193K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1733 packets, 139K bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   208 DOCKER     0    --  *      *       ::/0                !::1                  ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 14683 packets, 1175K bytes)
 pkts bytes target     prot opt in     out     source               destination
42336 3998K MASQUERADE  0    --  *      !br-mailcow  fd4d:6169:6c63:6f77::/64  ::/0
    0     0 MASQUERADE  0    --  *      docker0  ::/0                 ::/0                 ADDRTYPE match dst-type LOCAL
    1    80 MASQUERADE  0    --  *      !docker0  fd00:dead:beef:c0::/80  ::/0
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::d  fd4d:6169:6c63:6f77::d  tcp dpt:587
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::10  fd4d:6169:6c63:6f77::10  tcp dpt:443
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::e  fd4d:6169:6c63:6f77::e  tcp dpt:587
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::b  fd4d:6169:6c63:6f77::b  tcp dpt:4190
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::11  fd4d:6169:6c63:6f77::11  tcp dpt:587

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
   90  7200 RETURN     0    --  br-mailcow *       ::/0                 ::/0
    0     0 RETURN     0    --  docker0 *       ::/0                 ::/0
    5   384 DNAT       6    --  !br-mailcow *       ::/0                 ::/0                 tcp dpt:4190 to:[fd4d:6169:6c63:6f77::b]:4190

I haven’t configured any of these manually, I would assume they’re all configured by docker.