Closed maxileith closed 3 years ago
Hi Max,
That's a good catch!
I will fix it ASAP.
André
Had a similar problem, not with XMPP, but with custom sites: It turns out NGINX needs TLSv1.3 to be enabled on the default server section as well. It is not enough to just enable it in your virtual hosting sections (the ones containing a "server_name" directective). I guess this makes sense because SNI (and thus virtual hosting) is exchanged after TLSv1.3 is negotiated.
Prior to placing the issue, please check following: (fill out each checkbox with an
X
once done)Summary
Hello,
I have found a bug that causes the
ssl_*
settings of the configuration filedata/conf/nginx/includes/site-defaults.conf
to be ignored.I came across this bug because I was wondering why TLSv1.3 is not available over HTTPS, even though I enabled the setting in said file
ssl_protocols: TLSv1.2 TLSv1.3;
.The bug occurs exactly when XMPP is enabled for at least one domain. This results in errors appearing in the NGINX logs when loading the
site-defaults.conf
configuration file. See below.Logs
docker-compose logs -f --tail=200 nginx-mailcow
Reproduction
At this point, XMPP is disabled for all domains. TLSv1.3 works:
openssl s_client -showcerts -connect localhost:443 -servername example.org
Now enable XMPP for at least one domain and execute the following commands:
TLSv1.3 does not work now.
openssl s_client -showcerts -connect localhost:443 -servername example.org
System information
docker version
)docker-compose version
)Output of
git diff origin/master
, any other changes to the code? If so, please post them.git diff origin/master
+myhostname = mail.example.org +mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 [fe80::]/10 172.22.1.0/24 [fd4d:6169:6c63:6f77::]/64 diff --git a/data/conf/sogo/sogo.conf b/data/conf/sogo/sogo.conf index 2513f496..a17f05cb 100644 --- a/data/conf/sogo/sogo.conf +++ b/data/conf/sogo/sogo.conf @@ -27,8 +27,7 @@ // Example:
// SOGoDomainsVisibility = (
// (webmail.example.org) // );
// self-signed is not trusted anymore @@ -60,7 +59,7 @@ WONoDetach = YES;
SOGoIMAPAclConformsToIMAPExt = Yes;
SOGoPageTitle = "Webmail"; SOGoFirstDayOfWeek = "1";
SOGoSieveFolderEncoding = "UTF-8";
iptables -L -vn
,ip6tables -L -vn
,iptables -L -vn -t nat
andip6tables -L -vn -t nat
.iptables -L -vn
Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
80931 265M DOCKER-USER all -- 0.0.0.0/0 0.0.0.0/0
50978 20M DOCKER-ISOLATION-STAGE-1 all -- 0.0.0.0/0 0.0.0.0/0
26460 16M ACCEPT all -- br-mailcow 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 2389 151K DOCKER all -- br-mailcow 0.0.0.0/0 0.0.0.0/0
22129 3481K ACCEPT all -- br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
2389 151K ACCEPT all -- br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 1623K packets, 416M bytes) pkts bytes target prot opt in out source destination
Chain FILTERS (2 references) pkts bytes target prot opt in out source destination
4426K 4841M ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 11509 486K DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID 13 728 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:57462 3551 199K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 8494 495K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443 3764 200K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25 4532 271K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:465 788 46432 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:587 4344 260K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:143 14800 907K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:993 3565 213K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110 3857 231K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:995 18 1024 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:4190 3161 190K ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:63733 70 3696 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:5222 38 2068 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:5269 57 3268 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:5443 1338K 448M DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references) pkts bytes target prot opt in out source destination
3250K 3802M FILTERS all -- eth0 0.0.0.0/0 0.0.0.0/0
23M 12G RETURN all -- * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.249 tcp dpt:6379 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.6 tcp dpt:8983 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.7 tcp dpt:5443 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.7 tcp dpt:5269 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.7 tcp dpt:5222 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.9 tcp dpt:3306 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:12345 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:4190 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:587 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:995 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:465 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:993 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:25 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:143 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:110 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.12 tcp dpt:443 0 0 ACCEPT tcp -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.12 tcp dpt:80
Chain DOCKER-ISOLATION-STAGE-1 (1 references) pkts bytes target prot opt in out source destination
22129 3481K DOCKER-ISOLATION-STAGE-2 all -- br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
9534K 4749M RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (2 references) pkts bytes target prot opt in out source destination
0 0 DROP all -- br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- docker0 0.0.0.0/0 0.0.0.0/0
1343K 581M RETURN all -- 0.0.0.0/0 0.0.0.0/0
Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
2755 222K DOCKER all ::/0 ::/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
0 0 MASQUERADE all br-mailcow ::/0 ::/0 ADDRTYPE match dst-type LOCAL 172K 16M MASQUERADE all !br-mailcow fd4d:6169:6c63:6f77::/64 ::/0
0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::a fd4d:6169:6c63:6f77::a tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::a fd4d:6169:6c63:6f77::a tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::a fd4d:6169:6c63:6f77::a tcp dpt:5443 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::b fd4d:6169:6c63:6f77::b tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::b fd4d:6169:6c63:6f77::b tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::b fd4d:6169:6c63:6f77::b tcp dpt:5443 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:25 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:465 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:587 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::8 fd4d:6169:6c63:6f77::8 tcp dpt:25 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::8 fd4d:6169:6c63:6f77::8 tcp dpt:465 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::8 fd4d:6169:6c63:6f77::8 tcp dpt:587 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::c fd4d:6169:6c63:6f77::c tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::c fd4d:6169:6c63:6f77::c tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::c fd4d:6169:6c63:6f77::c tcp dpt:5443 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:25 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:465 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:587 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::12 fd4d:6169:6c63:6f77::12 tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::12 fd4d:6169:6c63:6f77::12 tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::12 fd4d:6169:6c63:6f77::12 tcp dpt:5443
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
20 1600 DOCKER all ::/0 !::1 ADDRTYPE match dst-type LOCAL
Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
0 0 RETURN all br-mailcow ::/0 ::/0
0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:110 to:[fd4d:6169:6c63:6f77::e]:110 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:143 to:[fd4d:6169:6c63:6f77::e]:143 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:4190 to:[fd4d:6169:6c63:6f77::e]:4190 5 420 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:993 to:[fd4d:6169:6c63:6f77::e]:993 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:995 to:[fd4d:6169:6c63:6f77::e]:995 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:25 to:[fd4d:6169:6c63:6f77::f]:25 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:465 to:[fd4d:6169:6c63:6f77::f]:465 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:587 to:[fd4d:6169:6c63:6f77::f]:587 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:5222 to:[fd4d:6169:6c63:6f77::a]:5222 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:5269 to:[fd4d:6169:6c63:6f77::a]:5269 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:5443 to:[fd4d:6169:6c63:6f77::a]:5443
Warning: ip6tables-legacy tables present, use ip6tables-legacy to see them
root@vmd47018:/opt/mailcow-dockerized# ip6tables -L -vn Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
240 270K ACCEPT all lo ::/0 ::/0
77537 5158K ACCEPT icmpv6 ::/0 ::/0
16M 1525M FILTERS all * ::/0 ::/0
Chain FORWARD (policy DROP 723 packets, 60826 bytes) pkts bytes target prot opt in out source destination
4542 8518K DOCKER-USER all ::/0 ::/0
4650K 9636M DOCKER-ISOLATION-STAGE-1 all ::/0 ::/0
4409K 9606M DOCKER all br-mailcow ::/0 ::/0
3815K 9564M ACCEPT all br-mailcow ::/0 ::/0 ctstate RELATED,ESTABLISHED 240K 29M ACCEPT all br-mailcow !br-mailcow ::/0 ::/0
594K 42M ACCEPT all br-mailcow br-mailcow ::/0 ::/0
Chain OUTPUT (policy ACCEPT 8188K packets, 113G bytes) pkts bytes target prot opt in out source destination
Chain FILTERS (2 references) pkts bytes target prot opt in out source destination
17M 1601M ACCEPT all ::/0 ::/0 state RELATED,ESTABLISHED 59 4332 DROP all ::/0 ::/0 state INVALID 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:57462 1112 88960 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:80 1235 98800 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:443 19 1520 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:25 3 244 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:465 42 3364 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:587 46 3708 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:143 250 21000 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:993 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:110 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:995 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:4190 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:63733 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:5222 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:5269 0 0 ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:5443 21 1795 DROP all ::/0 ::/0
Chain DOCKER-USER (1 references) pkts bytes target prot opt in out source destination
237K 76M FILTERS all eth0 ::/0 ::/0
4650K 9636M RETURN all * ::/0 ::/0
Chain DOCKER (1 references) pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::e tcp dpt:110 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::e tcp dpt:143 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::e tcp dpt:4190 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::e tcp dpt:993 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::e tcp dpt:995 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::f tcp dpt:25 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::f tcp dpt:465 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::f tcp dpt:587 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::a tcp dpt:5222 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::a tcp dpt:5269 0 0 ACCEPT tcp !br-mailcow br-mailcow ::/0 fd4d:6169:6c63:6f77::a tcp dpt:5443
Chain DOCKER-ISOLATION-STAGE-1 (1 references) pkts bytes target prot opt in out source destination
283 52436 DOCKER-ISOLATION-STAGE-2 all br-mailcow !br-mailcow ::/0 ::/0
4275 8463K RETURN all ::/0 ::/0
Chain DOCKER-ISOLATION-STAGE-2 (1 references) pkts bytes target prot opt in out source destination
0 0 DROP all br-mailcow ::/0 ::/0
283 52436 RETURN all * ::/0 ::/0
Warning: ip6tables-legacy tables present, use ip6tables-legacy to see them
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
63704 3756K DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
1438 109K MASQUERADE all -- !br-mailcow 172.22.1.0/24 0.0.0.0/0
0 0 MASQUERADE all -- !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp -- 172.22.1.249 172.22.1.249 tcp dpt:6379 0 0 MASQUERADE tcp -- 172.22.1.6 172.22.1.6 tcp dpt:8983 0 0 MASQUERADE tcp -- 172.22.1.7 172.22.1.7 tcp dpt:5443 0 0 MASQUERADE tcp -- 172.22.1.7 172.22.1.7 tcp dpt:5269 0 0 MASQUERADE tcp -- 172.22.1.7 172.22.1.7 tcp dpt:5222 0 0 MASQUERADE tcp -- 172.22.1.9 172.22.1.9 tcp dpt:3306 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:12345 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:4190 0 0 MASQUERADE tcp -- 172.22.1.11 172.22.1.11 tcp dpt:587 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:995 0 0 MASQUERADE tcp -- 172.22.1.11 172.22.1.11 tcp dpt:465 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:993 0 0 MASQUERADE tcp -- 172.22.1.11 172.22.1.11 tcp dpt:25 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:143 0 0 MASQUERADE tcp -- 172.22.1.250 172.22.1.250 tcp dpt:110 0 0 MASQUERADE tcp -- 172.22.1.12 172.22.1.12 tcp dpt:443 0 0 MASQUERADE tcp -- 172.22.1.12 172.22.1.12 tcp dpt:80
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
4 240 DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
1 60 RETURN all -- br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- docker0 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:7654 to:172.22.1.249:6379 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:18983 to:172.22.1.6:8983 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:5443 to:172.22.1.7:5443 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:5269 to:172.22.1.7:5269 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:5222 to:172.22.1.7:5222 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:13306 to:172.22.1.9:3306 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 127.0.0.1 tcp dpt:19991 to:172.22.1.250:12345 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:4190 to:172.22.1.250:4190 4 240 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 to:172.22.1.11:587 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:995 to:172.22.1.250:995 1 60 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 to:172.22.1.11:465 15 924 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 to:172.22.1.250:993 7 388 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 to:172.22.1.11:25 7 420 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 to:172.22.1.250:143 0 0 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 to:172.22.1.250:110 4 208 DNAT tcp -- !br-mailcow 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:172.22.1.12:443 6 308 DNAT tcp -- !br-mailcow * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.22.1.12:80
Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
2755 222K DOCKER all ::/0 ::/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
0 0 MASQUERADE all br-mailcow ::/0 ::/0 ADDRTYPE match dst-type LOCAL 172K 16M MASQUERADE all !br-mailcow fd4d:6169:6c63:6f77::/64 ::/0
0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::a fd4d:6169:6c63:6f77::a tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::a fd4d:6169:6c63:6f77::a tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::a fd4d:6169:6c63:6f77::a tcp dpt:5443 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::b fd4d:6169:6c63:6f77::b tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::b fd4d:6169:6c63:6f77::b tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::b fd4d:6169:6c63:6f77::b tcp dpt:5443 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:25 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:465 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::e fd4d:6169:6c63:6f77::e tcp dpt:587 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::4 fd4d:6169:6c63:6f77::4 tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::8 fd4d:6169:6c63:6f77::8 tcp dpt:25 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::8 fd4d:6169:6c63:6f77::8 tcp dpt:465 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::8 fd4d:6169:6c63:6f77::8 tcp dpt:587 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::c fd4d:6169:6c63:6f77::c tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::c fd4d:6169:6c63:6f77::c tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::c fd4d:6169:6c63:6f77::c tcp dpt:5443 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:110 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:143 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:4190 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:993 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::10 fd4d:6169:6c63:6f77::10 tcp dpt:995 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:25 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:465 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::f fd4d:6169:6c63:6f77::f tcp dpt:587 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::12 fd4d:6169:6c63:6f77::12 tcp dpt:5222 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::12 fd4d:6169:6c63:6f77::12 tcp dpt:5269 0 0 MASQUERADE tcp fd4d:6169:6c63:6f77::12 fd4d:6169:6c63:6f77::12 tcp dpt:5443
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
20 1600 DOCKER all ::/0 !::1 ADDRTYPE match dst-type LOCAL
Chain DOCKER (2 references) pkts bytes target prot opt in out source destination
0 0 RETURN all br-mailcow ::/0 ::/0
0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:110 to:[fd4d:6169:6c63:6f77::e]:110 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:143 to:[fd4d:6169:6c63:6f77::e]:143 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:4190 to:[fd4d:6169:6c63:6f77::e]:4190 5 420 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:993 to:[fd4d:6169:6c63:6f77::e]:993 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:995 to:[fd4d:6169:6c63:6f77::e]:995 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:25 to:[fd4d:6169:6c63:6f77::f]:25 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:465 to:[fd4d:6169:6c63:6f77::f]:465 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:587 to:[fd4d:6169:6c63:6f77::f]:587 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:5222 to:[fd4d:6169:6c63:6f77::a]:5222 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:5269 to:[fd4d:6169:6c63:6f77::a]:5269 0 0 DNAT tcp !br-mailcow ::/0 ::/0 tcp dpt:5443 to:[fd4d:6169:6c63:6f77::a]:5443
Warning: ip6tables-legacy tables present, use ip6tables-legacy to see them
1.254 151.101.65.69 151.101.193.69 151.101.1.69 151.101.129.69