internal tunnel ip in logs

d3nny

Hey there,

currently I’m using an external gateway to get into the internet in and out.
Mailcow is connected via VPN to this gateway.
Gateway got IP 10.10.10.1.
Internal mailcow network is 172.22.1.0/24.

My problem is now that every access log is showing 10.10.10.1 as source ip and not the “real” ip.
Gateway is sending every request via iptables NAT.

So in nginx-mailcow the 10.0.0.0/8 network is already in set_real_ip_from. I also tried setting “TRUSTED_PROXIES=” to the public ip of the gateway but this also didn’t changed anything.

Any hints for me or solutions? Thanks in advance!

ETNyx

Hello,

what you can try

1) Seems that you are using MASQUERADE on your gateway, So if you switch to DNAT only (drop SNAT/MASQUERADE) gateway will only relay your packets without manipulating whit source address (more commonly known as port forwarding). You just need to make sure MC will return traffic via same gateway, so you will not create asymmetric connections that will be seen as broken, most-likely,…

2) use Proxy protocol instead of firewall.

d3nny

ETNyx

Thanks for your input.
My current iptables are using only DNAT

Chain PREROUTING (policy ACCEPT 642K packets, 39M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:143 to:10.10.10.2:143
15267  902K DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:993 to:10.10.10.2:993
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:110 to:10.10.10.2:110
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:995 to:10.10.10.2:995
 4039  229K DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:587 to:10.10.10.2:587
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:465 to:10.10.10.2:465
 271K   14M DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:10.10.10.2:81
2926K  163M DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 to:10.10.10.2:444

Chain INPUT (policy ACCEPT 407K packets, 24M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 908K packets, 75M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 904K packets, 74M bytes)
 pkts bytes target     prot opt in     out     source               destination
3220K  179M MASQUERADE  all  --  *      wg0     0.0.0.0/0            0.0.0.0/0

use proxy protocol:
I tried it when I started this “project” but I don’t know what was not working properly. I was trying to use the proxy protocal with haproxy (haproxy listened on port 80 and 443 and used the 10.10.10.2 as backend with their ports). But somehow it wasn’t worked at all. Couldn’t established any connections and so on that’s why I switched to just port forwarding via iptables.

ETNyx

This is your problem right now:
eth0 (internet) > PREROUTING push packet to wg0 > POSTROUTING due to MASQUERADE rewrite packet source IP > wg0 (Mailcow)

Check those counters it’s basicly 1:1. As i wrote before you need to get rid of this so: iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE or maybe more defensively if you need it for something else iptables -t nat -I POSTROUTING -o wg0 -d 10.10.10.2 -j ACCEPT

d3nny

ETNyx
you’re totally right. Was a masq thing.
I managed to handle now everything with haproxy proxy_protocol.
Thanks a lot!

ETNyx

Glad you work it out, also re-check your rules at minimum you need 25 port for server-to-server communication.

Check the docs please.

d3nny

ETNyx
yeah I know that. Port 25 is handled a little bit different here ’cause of some services which are filtering beforehand sending it to mailcow. But thanks for the hint :-)