Mailcow relaying spam, even though open relay is disabled

DocFraggle

What does the netfilter log show now?

kolaente

Using IPTables backend
Clearing all bans
Initializing mailcow netfilter chain
Setting MAILCOW isolation
Watching Redis channel F2B_CHANNEL
81.30.107.49 matched rule id 1 (warning: unknown[81.30.107.49]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=y-yamada)
9 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.168 matched rule id 1 (warning: unknown[81.30.107.168]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=isabela)
8 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.19 matched rule id 1 (warning: unknown[81.30.107.19]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=zorn)
7 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.173 matched rule id 1 (warning: unknown[81.30.107.173]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=jikken)
6 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.38 matched rule id 1 (warning: unknown[81.30.107.38]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=room)
5 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.153 matched rule id 1 (warning: unknown[81.30.107.153]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=raju)
4 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.52 matched rule id 1 (warning: unknown[81.30.107.52]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=hh)
3 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.70 matched rule id 1 (warning: unknown[81.30.107.70]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=listserv)
2 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.88 matched rule id 1 (warning: unknown[81.30.107.88]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=newton)
1 more attempts in the next 600 seconds until 81.30.107.0/24 is banned
81.30.107.189 matched rule id 1 (warning: unknown[81.30.107.189]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=otawakesan)
Banning 81.30.107.0/24 for 30 minutes

seems to be fine?

DocFraggle

kolaente seems to be fine?

Yes, looks better now. Did the iptables rules change? Just for reference, this is my ip6tables config:

# ip6tables -L -vn

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
10065 6053K MAILCOW    0    --  *      *       ::/0                 ::/0                 /* mailcow */
2205K 1002M DOCKER-USER  0    --  *      *       ::/0                 ::/0                
2205K 1002M DOCKER-FORWARD  0    --  *      *       ::/0                 ::/0                

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::10  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::10  tcp dpt:465
    3   240 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::10  tcp dpt:25
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::a  tcp dpt:4190
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::a  tcp dpt:995
   11   912 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::a  tcp dpt:993
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::a  tcp dpt:143
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::a  tcp dpt:110
  136 10932 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::f  tcp dpt:443
   81  6480 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::f  tcp dpt:80
    0     0 DROP       0    --  !docker0 docker0  ::/0                 ::/0                
    0     0 DROP       0    --  !br-mailcow br-mailcow  ::/0                 ::/0                

Chain DOCKER-BRIDGE (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER     0    --  *      docker0  ::/0                 ::/0                
  232 18644 DOCKER     0    --  *      br-mailcow  ::/0                 ::/0                

Chain DOCKER-CT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     0    --  *      docker0  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
 4872 1125K ACCEPT     0    --  *      br-mailcow  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED

Chain DOCKER-FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination         
2205K 1002M DOCKER-CT  0    --  *      *       ::/0                 ::/0                
1137K  771M DOCKER-ISOLATION-STAGE-1  0    --  *      *       ::/0                 ::/0                
1137K  771M DOCKER-BRIDGE  0    --  *      *       ::/0                 ::/0                
    0     0 ACCEPT     0    --  docker0 *       ::/0                 ::/0                
 5006 4925K ACCEPT     0    --  br-mailcow *       ::/0                 ::/0                

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  ::/0                 ::/0                
 5006 4925K DOCKER-ISOLATION-STAGE-2  0    --  br-mailcow !br-mailcow  ::/0                 ::/0                

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       0    --  *      br-mailcow  ::/0                 ::/0                
    0     0 DROP       0    --  *      docker0  ::/0                 ::/0                

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain MAILCOW (1 references)
 pkts bytes target     prot opt in     out     source               destination

# ip6tables -L -vn -t nat

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
68571 5927K DOCKER     0    --  *      *       ::/0                 ::/0                 ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  137 10960 DOCKER     0    --  *      *       ::/0                !::1                  ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2238  276K MASQUERADE  0    --  *      !br-mailcow  fd4d:6169:6c63:6f77::/64  ::/0                
    0     0 MASQUERADE  0    --  *      !docker0  fd00:dead:beef:c0::/80  ::/0                

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
   64  5120 RETURN     0    --  br-mailcow *       ::/0                 ::/0                
    0     0 RETURN     0    --  docker0 *       ::/0                 ::/0                
   81  6480 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:80 to:[fd4d:6169:6c63:6f77::f]:80
  136 10932 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:443 to:[fd4d:6169:6c63:6f77::f]:443
    0     0 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:110 to:[fd4d:6169:6c63:6f77::a]:110
    0     0 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:143 to:[fd4d:6169:6c63:6f77::a]:143
   11   912 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:993 to:[fd4d:6169:6c63:6f77::a]:993
    0     0 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:995 to:[fd4d:6169:6c63:6f77::a]:995
    0     0 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:4190 to:[fd4d:6169:6c63:6f77::a]:4190
    3   240 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:25 to:[fd4d:6169:6c63:6f77::10]:25
    0     0 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:465 to:[fd4d:6169:6c63:6f77::10]:465
    0     0 DNAT       6    --  !br-mailcow *      !fe80::/10            ::/0                 tcp dpt:587 to:[fd4d:6169:6c63:6f77::10]:587

As you can see, all ports are included there. In your output above most of them are missing, and it looks completly different

kolaente

It seems to be pretty similar to what I had earlier:

# ip6tables -L -vn -t nat

Chain PREROUTING (policy ACCEPT 2221 packets, 205K bytes)
 pkts bytes target     prot opt in     out     source               destination
6173K  517M DOCKER     0    --  *      *       ::/0                 ::/0                 ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 103 packets, 8244 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 95 packets, 7600 bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   208 DOCKER     0    --  *      *       ::/0                !::1                  ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 404 packets, 32344 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1809  172K MASQUERADE  0    --  *      !br-mailcow  fd4d:6169:6c63:6f77::/64  ::/0
    0     0 MASQUERADE  0    --  *      docker0  ::/0                 ::/0                 ADDRTYPE match dst-type LOCAL
    1    80 MASQUERADE  0    --  *      !docker0  fd00:dead:beef:c0::/80  ::/0
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::d  fd4d:6169:6c63:6f77::d  tcp dpt:587
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::10  fd4d:6169:6c63:6f77::10  tcp dpt:443
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::e  fd4d:6169:6c63:6f77::e  tcp dpt:587
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::11  fd4d:6169:6c63:6f77::11  tcp dpt:587
    0     0 MASQUERADE  6    --  *      *       fd4d:6169:6c63:6f77::b  fd4d:6169:6c63:6f77::b  tcp dpt:4190

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
   45  3600 RETURN     0    --  br-mailcow *       ::/0                 ::/0
    0     0 RETURN     0    --  docker0 *       ::/0                 ::/0
    0     0 DNAT       6    --  !br-mailcow *       ::/0                 ::/0                 tcp dpt:4190 to:[fd4d:6169:6c63:6f77::b]:4190

# ip6tables -L -vn
Chain INPUT (policy ACCEPT 9217 packets, 3503K bytes)
 pkts bytes target     prot opt in     out     source               destination
 9232 3504K MAILCOW    0    --  *      *       ::/0                 ::/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
13567 4505K MAILCOW    0    --  *      *       ::/0                 ::/0
13567 4505K DOCKER-USER  0    --  *      *       ::/0                 ::/0
13567 4505K DOCKER-ISOLATION-STAGE-1  0    --  *      *       ::/0                 ::/0
 6175 3935K ACCEPT     0    --  *      br-mailcow  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
 5477  369K DOCKER     0    --  *      br-mailcow  ::/0                 ::/0
 1915  200K ACCEPT     0    --  br-mailcow !br-mailcow  ::/0                 ::/0
 5477  369K ACCEPT     0    --  br-mailcow br-mailcow  ::/0                 ::/0
    0     0 ACCEPT     0    --  *      docker0  ::/0                 ::/0                 ctstate RELATED,ESTABLISHED
    0     0 DOCKER     0    --  *      docker0  ::/0                 ::/0
    0     0 ACCEPT     0    --  docker0 !docker0  ::/0                 ::/0
    0     0 ACCEPT     0    --  docker0 docker0  ::/0                 ::/0

Chain OUTPUT (policy ACCEPT 8939 packets, 4815K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::d  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::d  tcp dpt:465
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::10  tcp dpt:443
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::e  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::e  tcp dpt:465
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::11  tcp dpt:587
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::11  tcp dpt:465
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::b  tcp dpt:4190
    0     0 ACCEPT     6    --  !br-mailcow br-mailcow  ::/0                 fd4d:6169:6c63:6f77::b  tcp dpt:995

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
 1915  200K DOCKER-ISOLATION-STAGE-2  0    --  br-mailcow !br-mailcow  ::/0                 ::/0
    0     0 DOCKER-ISOLATION-STAGE-2  0    --  docker0 !docker0  ::/0                 ::/0
 190M  112G RETURN     0    --  *      *       ::/0                 ::/0

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       0    --  *      br-mailcow  ::/0                 ::/0
    0     0 DROP       0    --  *      docker0  ::/0                 ::/0
  11M 3218M RETURN     0    --  *      *       ::/0                 ::/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
 191M  113G RETURN     0    --  *      *       ::/0                 ::/0

Chain MAILCOW (2 references)
 pkts bytes target     prot opt in     out     source               destination

Especially the nat stuff seems to be missing.

DocFraggle

OK strange… you could try to completely reset your iptables rules and let mailcow rebuild them. I think you should stop the stack before you’re starting:

docker compose down

Then reset everything to the default:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X
iptables -t security -F
iptables -t security -X
iptables -Z

ip6tables -F
ip6tables -X
ip6tables -t nat -F
ip6tables -t nat -X
ip6tables -t mangle -F
ip6tables -t mangle -X
ip6tables -t raw -F
ip6tables -t raw -X
ip6tables -t security -F
ip6tables -t security -X
ip6tables -Z

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT

That’s the “factory default” 🙂 Then start the stack again

systemctl restart docker
docker compose up -d

EDIT: sorry, I double-pasted the first iptables block

EDIT 2: maybe dont run this at all, I get an error while starting it on my test system

EDIT 3: ok, just had to restart the docker service before starting mailcow

kolaente

In restarting the docker daemon, I got this error (and it wont start):

Sep 12 15:54:18 mailcow dockerd[49349]: time="2025-09-12T15:54:18.812248856+02:00" level=info msg="Starting up"
Sep 12 15:54:18 mailcow dockerd[49349]: time="2025-09-12T15:54:18.812485870+02:00" level=warning msg="Running experimental build"
Sep 12 15:54:18 mailcow dockerd[49349]: time="2025-09-12T15:54:18.855128967+02:00" level=info msg="[graphdriver] using prior storage driver: overlay2"
Sep 12 15:54:18 mailcow dockerd[49349]: time="2025-09-12T15:54:18.906492169+02:00" level=info msg="Loading containers: start."
Sep 12 15:54:19 mailcow dockerd[49349]: time="2025-09-12T15:54:19.024040120+02:00" level=warning msg="could not create bridge network for id 1d7fd7d2e49c8d3fb61385a8a8d4387d5db01d30901b43ca9a8db8a1f5dbff35 bridge name docker0 while booting up from persistent state: Failed to Setup IP tables: Unable to disable MASQ LOC>
Sep 12 15:54:19 mailcow dockerd[49349]: time="2025-09-12T15:54:19.096145114+02:00" level=info msg="Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. Daemon option --bip can be used to set a preferred IP address"
Sep 12 15:54:19 mailcow dockerd[49349]: time="2025-09-12T15:54:19.119754293+02:00" level=info msg="stopping event stream following graceful shutdown" error="<nil>" module=libcontainerd namespace=moby
Sep 12 15:54:19 mailcow dockerd[49349]: failed to start daemon: Error initializing network controller: error creating default "bridge" network: Failed to Setup IP tables: Unable to disable MASQ LOCAL HOST rule:  (iptables failed: ip6tables --wait -t nat -D POSTROUTING -m addrtype --src-type LOCAL -o docker0 -j MASQUER>
Sep 12 15:54:19 mailcow dockerd[49349]:  (exit status 1))
Sep 12 15:54:19 mailcow systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE

This seems to be related to broken ipv6?

I’ve tried a few things but the docker daemon would not come up… After rebooting the server, it started without issues.
The output from iptables still look the same as before.

DocFraggle

OK, I’m officially out of ideas… but I guess it has something to do with your ip6tables configuration…

DocFraggle

So I just had a look again, maybe we can check each other’s configs for differences.

Here’s my daemon.json:

# cat /etc/docker/daemon.json 
{"ipv6":true,"fixed-cidr-v6":"fd00:dead:beef:c0::/80","experimental":true,"ip6tables":true}

Also, I’m running Docker 28:

# docker version
Client: Docker Engine - Community
 Version:           28.4.0
 API version:       1.51
 Go version:        go1.24.7
 Git commit:        d8eb465
 Built:             Wed Sep  3 20:57:37 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.4.0
  API version:      1.51 (minimum version 1.24)
  Go version:       go1.24.7
  Git commit:       249d679
  Built:            Wed Sep  3 20:57:37 2025
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

What’s your output of

# lsmod | grep ip6
ip6_tables             36864  0
x_tables               61440  11 xt_conntrack,nft_compat,xt_LOG,xt_tcpudp,xt_addrtype,xt_nat,xt_comment,xt_set,ip6_tables,ip_tables,xt_MASQUERADE
``

ETNyx

@DocFraggle can you double check latest posted iptables? As casual network operator if I imagine flow of 25/tcp it get into nat/PREROUTING from there jump nat/DOCKER I would expected DNAT to 25 there like 4190 to be translated into container.

This setup without DNAT seems to keep host as destination. Not sure how packet get into MC postfix but it could explain open relay by triggering permit_mynetworks since source could be seen from host?

kolaente

My daemon.json looks pretty much the same:

{"ipv6":true,"fixed-cidr-v6":"fd00:dead:beef:c0::/80","experimental":true,"ip6tables":true}

But I’m running docker 26:

Client: Docker Engine - Community
 Version:           26.1.4
 API version:       1.45
 Go version:        go1.21.11
 Git commit:        5650f9b
 Built:             Wed Jun  5 11:29:15 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          26.1.4
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.11
  Git commit:       de5c9cf
  Built:            Wed Jun  5 11:29:15 2024
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.6.33
  GitCommit:        d2d58213f83a351ca8f528a95fbd145f5654e957
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

which is interesting, because apt update does not report any new packages available. I’m using the official docker debian repo here.

# lsmod | grep ip6

ip6table_security      16384  0
ip6table_raw           16384  0
ip6table_mangle        16384  0
ip6table_nat           16384  1
ip6table_filter        16384  1
ip6_tables             36864  5 ip6table_filter,ip6table_raw,ip6table_nat,ip6table_mangle,ip6table_security
nf_nat                 57344  4 ip6table_nat,xt_nat,iptable_nat,xt_MASQUERADE
x_tables               61440  19 ip6table_filter,xt_conntrack,ip6table_raw,iptable_filter,iptable_security,ip6table_nat,xt_multiport,xt_tcpudp,xt_addrtype,xt_nat,ip6_tables,ipt_REJECT,iptable_raw,ip_tables,iptable_nat,ip6table_mangle,ip6table_security,xt_MASQUERADE,iptable_mangle

(I have no idea what any of this means)

ETNyx This setup without DNAT seems to keep host as destination. Not sure how packet get into MC postfix but it could explain open relay by triggering permit_mynetworks since source could be seen from host?

Wouldn’t that mean this is a problem all mailcows have?

DocFraggle Yes, it is possible that due to the missing DNAT rule the traffic via the public IPv6 address is routed internally through an interface in the [fd4d:6169:6c63:6f77::]/64 network, and because it’s included in mynetworks it’s allowed to relay

Is there a way to figure out if this is the case?

DocFraggle

kolaente $ docker exec -it mailcowdockerized-postfix-mailcow-1 postconf mynetworks
mynetworks = 127.0.0.0/8 172.22.1.0/24 [::1]/128 [fd4d:6169:6c63:6f77::]/64 [fe80::]/64

Yes, it is possible that due to the missing DNAT rule the traffic via the public IPv6 address is routed internally through an interface in the [fd4d:6169:6c63:6f77::]/64 network, and because it’s included in mynetworks it’s allowed to relay

DocFraggle

kolaente I’m using the official docker debian repo here

This is my apt source file (created a few years back by the docker install script from https://get.docker.com/):

# cat /etc/apt/sources.list.d/docker.list 
deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable

And these are my docker packages:

# dpkg -l docker
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-=================================
un  docker         <none>       <none>       (no description available)
root@mailserver:/opt/mailcow-dockerized# dpkg -l | grep docker
ii  docker-buildx-plugin                                        0.27.0-1~debian.12~bookworm     amd64        Docker Buildx cli plugin.
ii  docker-ce                                                   5:28.4.0-1~debian.12~bookworm   amd64        Docker: the open-source application container engine
ii  docker-ce-cli                                               5:28.4.0-1~debian.12~bookworm   amd64        Docker CLI: the open-source application container engine
ii  docker-ce-rootless-extras                                   5:28.4.0-1~debian.12~bookworm   amd64        Rootless support for Docker.
ii  docker-compose-plugin                                       2.39.2-1~debian.12~bookworm     amd64        Docker Compose (V2) plugin for the Docker CLI.
ii  python3-docker                                              5.0.3-1                         all          Python 3 wrapper to access docker.io's control socket

ETNyx

kolaente Wouldn’t that mean this is a problem all mailcows have?

Do not think so, my guess you was left whit somehow mangled iptables, remember your problem was ipv6 only, ipv4 was alright,… Did you reset your iptables like Doc suggested? We could be able to diff ipv4 vs ipv6 I tend to keep those close as possible, ipv6 usually have few quirks on top.

« Previous Page