Mailinabox behind mikrotik router

[matz]

Hello.

I Installed succesfully mailinabox 0.19a on my Ubuntu Server 14.04.5 (clean install).
I forward ports on my mikrotik correctly - 25,22,53 tcp, 53 udp, 443, 80, 587, 993, 995, 4190 and i check it with paping, evertything is good with forward and ports are open.
I can send and receive mail from and to mailinabox and gmail (not spam) but I still get warnings in status check page:

SSH Login (ssh) is running but is not publicly accessible at

Public DNS (nsd4) is not running (port 53).

Incoming Mail (SMTP/postfix) is running but is not publicly accessible at

Outgoing Mail (SMTP 587/postfix) is running but is not publicly accessible at

IMAPS (dovecot) is running but is not publicly accessible at

Mail Filters (Sieve/dovecot) is running but is not publicly accessible at

HTTP Web (nginx) is running but is not publicly accessible at

HTTPS Web (nginx) is running but is not publicly accessible at

I have no idea what I did wrong.

Btw: Mailinabox is great! Good Job! Thank You!

[murgero]

DNS port 53 is UDP not TCP, so make sure when forwarding you select UDP as the protocol.

For all other ports (That I know of) they are TCP ONLY.

[arandomguy]

It has to do with running your box behind a router. I had been running my server for almost a year with the same errors you have until I had this reply on my thread.

Btw. If you are hosting your server yourself on a private network you don’t have to have ssh access. I have a vpn that connects to the network I’m hosting my server on so I disabled public ssh access for added security, I just ignore the ssh error on the status checks page.

@lloydsmart

It’s to do with being behind a NAT. I had the same trouble running MiaB within an LXC container.

I had to turn on something called “NAT hairpinning” on the virtual bridge I was using. Try searching for something like that for your pfSense firewall.

It’s a bit complicated, but basically the issue is that the traffic generated by the status checks reaches your NAT/firewall, and then doesn’t get routed back to your box like you’d think it would. This is because your firewall is only configured to forward external “incoming” packets to your box, but it sees this traffic as “internal” traffic that’s trying to get to your public IP. Since the firewall is your public IP, it thinks that the traffic has reached its destination, and it just dies there.

This only happens when the box tries to talk to itself over the public IP. That’s why all the external stuff is probably working just fine, and also why you can access the box over its internal IP without any issues.

What you need is a way for the firewall to know to treat traffic coming from your internal box IP that’s bound for your public IP the same as incoming traffic, and forward it back to your MiaB IP accordingly.

That’s what hairpinning does.

Hope that made sense.

[matz]

Thank You!

Its working now!

Solution for me:

https://yaleman.org/2014/10/23/hairpin-nat-on-mikrotik-v6-19/