Skip to content

Document a warning that disabled IPv6 may lead to an open relay #858

@jolly-jump

Description

@jolly-jump

Hi.

I'm rather opening this in the documentation region since this is rather a docker issue than a mailcow issue.

See: https://community.mailcow.email/d/5013-massenhaft-bounces-durch-spam/8 (german)

The gist is:

  • when you have an IPv6 stack it is hard to deactivate it
  • the rules documented are not sufficient (in my case)
  • As soon as I disable IPv6 as the docs say, the docker stack still creates docker-proxy for IPv6,
  • This docker-proxy forwards/nat's everything from IPv6 to the postfix IPv4 Adress,
  • Since there is no nat'ing (the IPv6 firewall is disabled) the postfix identifies the request coming from 172.11.1.1
  • ...thus automatically accepting mails that are forged to be from my server. -> Open relay 👿

I found several workarounds and i think the best would be to pin the port to the IPv4-address in mailcow.conf like SMTP_PORT=0.0.0.0:25

If no one else has the problem, this ticket can be closed.
The reaction on the thread was minimal, so maybe I'm alone and this is a special case.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions