Am 21.12.22 um 09:45 schrieb Samer Afach:
Thank you for these hints, Benny. I wanna point out that I'm, in no way, an expert in any of this, and my configuration is based on online research and some copy/paste.
Then with all due respect, please shut down your mail server and do not start it again until you have fully understood what your services are doing, and need to do instead in order to be operated securely. We don't need more public accidents. Postfix has ways to let application-level proxies convey actual client IP (XCLIENT). You will want those in the logs, and not your proxy's IP address. Sooner or later you will find it necessary to at least temporarily block offending subnets. If your proxy can't do that, or you don't know how, or you don't know how to do that with containers, perhaps use postscreen instead and run your Postfix on a bridged networked container of VM instead. I do not believe you (personally - no offense, but after your statement above) are currently fit for setting up and operating such a complex setup as you are using with several proxy and NAT layers and all that. Containers may seem like a good idea, but if they dispose of crucial information such as the client address, then revise your setup THOROUGHLY. Sorry to be blunt without asking, but we've all had our shares of eating unsolicited e-mail. Thank you.
