Mailcowdockerized and networking

cobra802vt_88460

I used the documentation to setup mailcow-dockerized in Orbstack. After running the setup script, it created all the containers on its own mailcow network so everything is behind the Orbstack/Docker bridge network and being NATd as this is standard for most container setups. Question though is now all connections to postfix or dovecot will be natd and come from a single ip of 172.22.1.1 so postfix will be unable to inspect the client connection ip’s and block accordingly. You also have to remove my_networks from smtpd_relay_restrictions or the mail server is an open relay right out of the box. I have scanned the documentation and internet to see if I missed something on setting up mailcow-dockerized or if this is normal behavior. Even my friend ChatGTP was unable to find anything otherwise. Any help would be appreciated, it does work like this but it seems like all ability to stop spammers and bad actors connecting to the servers is lost in this setup scenario.

D4niel

cobra802vt_88460 Question though is now all connections to postfix or dovecot will be natd and come from a single ip of 172.22.1.1

That’s not how NAT works. You probably ran into this issue:

cobra802vt_88460

D4niel I had read about that earlier and I set
ENABLE_IPV6=false
in mailcow.conf right from the beginning. If you look at everything in the mailcow docker-compose.yml it sets all the containers on 172.22.1.0 network which is the mailcow bridge network it creates and is behind the orbstack proxy so all connections that connect to postfix show coming from 172.22.1.1. I have searched high and low through the internet to find what I am possibly missing and not even any of the AI’s have been able to solve it. As far as I can find is the only way for containers to see the actual client ip connection address is to be configured in host networking mode which mailcow-dockerized does not do.

esackbauer

cobra802vt_88460 the only way for containers to see the actual client ip connection address is to be configured in host networking mode which mailcow-dockerized does not do.

According to the docs, only full virtualization platforms are supported, for this very reason:
https://docs.mailcow.email/getstarted/prerequisite-system/
Orbstack has some limitations, e.g. its always NATed, so you end up with a double NAT in mailcow which hides the originating public IP address.
I would suggest you use a different, supported Hypervisor.

cobra802vt_88460

esackbauer OK thanks, I didn’t understand the limitations of containers in Orbstack. I was able to get a workaround by implementing HAProxy in front of Orbstack. So now all connections are seeing the correct ip address, the only issue it won’t solve is netfilter as that will still be unable to block but otherwise everything else is working. now.