netfilter-mailcow infinite restart loop / endlose Neustart-Schleife
Author: meehrCreated Sep 10, 2026Updated Sep 10, 2026
Labelsbug
Contribution guidelines
- I've read the contribution guidelines and wholeheartedly agree
Checklist prior issue creation
- I understand that failure to follow below instructions may cause this issue to be closed.
- I understand that vague, incomplete or inaccurate information may cause this issue to be closed.
- I understand that this form is intended solely for reporting software bugs and not for support-related inquiries.
- I understand that all responses are voluntary and community-driven, and do not constitute commercial support.
- I confirm that I have reviewed previous issues to ensure this matter has not already been addressed.
- I confirm that my environment meets all prerequisite requirements as specified in the official documentation.
Description
Zusammenfassung / Summary
- **DE**: Der Container `netfilter-mailcow` gerät in eine endlose Neustart-Schleife (alle 10 Sekunden), wenn das `MAILCOW`-Target in der `ip6tables` `FORWARD`-Kette unterhalb von
Standard-Docker-Ketten (DOCKER-USER, DOCKER-FORWARD) platziert wird.
- EN: The netfilter-mailcow container enters an infinite restart loop (restarting every 10 seconds) when the MAILCOW target rule in the ip6tables FORWARD chain is pushed
below standard Docker chains (DOCKER-USER, DOCKER-FORWARD).
---
## Fehlerbeschreibung / Describe the bug
- **DE**:
Der Container protokolliert alle 10 Sekunden folgenden kritischen Fehler und beendet sich selbst:
`CRIT: MAILCOW target is in position 3 in the ip6 forward table, restarting container to fix it...`
Da das Neu Starten des Containers die von Docker angelegten Ketten (`DOCKER-USER` / `DOCKER-FORWARD`) nicht verändert, bleibt der Container in einer dauerhaften Neustart-Schleife
hängen (mehrere tausend Restarts, was Monitoring-Tools wie cAdvisor/Prometheus/Grafana mit phantom-inaktiven Containern überflutet).
- **EN**:
The container logs the following critical error every 10 seconds before terminating:
`CRIT: MAILCOW target is in position 3 in the ip6 forward table, restarting container to fix it...`
Since restarting the container does not alter the existence of `DOCKER-USER` / `DOCKER-FORWARD` chains inserted by Docker/Host firewall managers, the container crashes and
restarts endlessly (resulting in thousands of container restarts and spamming monitoring agents with transient container IDs).
## ✅ Erwartetes Verhalten / Expected behavior
- **DE**: `netfilter-mailcow` sollte Standard-Docker-Ketten oberhalb der `MAILCOW`-Regel tolerieren oder Positionsprüfungen ohne eine endlose `sys.exit(1)`-Neustart-Schleife
verarbeiten.
- EN: netfilter-mailcow should tolerate standard Docker/firewall chains present above the MAILCOW rule or handle chain positions gracefully without entering an infinite
sys.exit(1) restart loop.
---
## ❌ Tatsächliches Verhalten / Actual behavior
- **DE**: `netfilter-mailcow` erkennt `MAILCOW` an Position 3 (da `DOCKER-USER` auf Pos 1 und `DOCKER-FORWARD` auf Pos 2 stehen), gibt einen CRIT-Fehler aus und beendet sich,
woraufhin Docker den Container endlos neu startet.
- EN: netfilter-mailcow detects MAILCOW at position 3 (due to DOCKER-USER at pos 1, DOCKER-FORWARD at pos 2), emits a CRIT error, and exits, causing Docker to restart it
indefinitely.
──────
Workaround / Umgehungslösung
• DE: Das Setzen von DISABLE_NETFILTER_ISOLATION_RULE=y in der mailcow.conf deaktiviert die Positionsprüfung der Isolationsregel und stabilisiert den Container dauerhaft. Die Fail2ban-Sperrfunktion von Mailcow bleibt weiterhin aktiv. • EN: Setting DISABLE_NETFILTER_ISOLATION_RULE=y in mailcow.conf stops the position enforcement check and stabilizes the container while keeping fail2ban IP banning active.
Steps to reproduce:
Schritte zur Reproduktion / Steps to reproduce
1. **DE**: Mailcow-dockerized auf einem Linux-Host mit aktiviertem IPv6 und `iptables-nft` / `nftables` ausführen.
**EN**: Run `mailcow-dockerized` on a host using `iptables-nft` / `nftables` with IPv6 enabled.
2. **DE**: Sicherstellen, dass Docker die Standard-Ketten (`DOCKER-USER`, `DOCKER-FORWARD`) in der IPv6 `FORWARD`-Kette vor Mailcow platziert hat.
**EN**: Ensure Docker has inserted default chains (`DOCKER-USER`, `DOCKER-FORWARD`) into the `FORWARD` chain of `ip6tables`.
3. **DE**: `DISABLE_NETFILTER_ISOLATION_RULE=n` in der `mailcow.conf` belassen.
**EN**: Keep `DISABLE_NETFILTER_ISOLATION_RULE=n` in `mailcow.conf`.
4. **DE**: Logs prüfen via `docker logs mailcowdockerized-netfilter-mailcow-1`.
**EN**: Inspect `docker logs mailcowdockerized-netfilter-mailcow-1`.Logs:
## Logs & Diagnosedaten / Logs & Diagnostics
### Container Logs (`netfilter-mailcow`):
INFO: Initializing mailcow netfilter chain
INFO: MAILCOW ip chain created successfully.
INFO: Setting MAILCOW isolation
INFO: Watching Redis channel F2B_CHANNEL
CRIT: MAILCOW target is in position 3 in the ip6 forward table, restarting container to fix it...
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
### Host Firewall Rule Order (ip6tables -L FORWARD -n -v --line-numbers):
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 282K 124M DOCKER-USER 0 -- * * ::/0 ::/0
2 282K 124M DOCKER-FORWARD 0 -- * * ::/0 ::/0
3 5901K 1840M MAILCOW 0 -- * * ::/0 ::/0 /* mailcow */Which branch are you using?
master (stable)
Which architecture are you using?
x86_64
Operating System:
Ubuntu 24.04.5 LTSServer/VM specifications:
64Gb, 20 Core
Is Apparmor, SELinux or similar active?
no
Virtualization technology:
Server is a KVM VM
Docker version:
29.08
docker-compose version or docker compose version:
v5.5.1
mailcow version:
2026-07b
Reverse proxy:
traefik
Logs of git diff:
Logs of iptables -L -vn:
Chain INPUT (policy ACCEPT 11M packets, 4144M bytes)
pkts bytes target prot opt in out source destination
4807 980K MAILCOW 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* mailcow */
1029K 226M CROWDSEC_CHAIN 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
122K 232M MAILCOW 0 -- * * 0.0.0.0/0 0.0.0.0/0 /* mailcow */
16M 27G DOCKER-USER 0 -- * * 0.0.0.0/0 0.0.0.0/0
16M 27G DOCKER-FORWARD 0 -- * * 0.0.0.0/0 0.0.0.0/0
701 219K CROWDSEC_CHAIN 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain CROWDSEC_CHAIN (3 references)
pkts bytes target prot opt in out source destination
10590 794K DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set crowdsec-blacklists-4 src /* CrowdSec: crowdsec */
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set crowdsec-blacklists-3 src /* CrowdSec: lists:tor-exit-nodes */
5752 280K DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set crowdsec-blacklists-2 src /* CrowdSec: lists:firehol_greensnow */
400 18559 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set crowdsec-blacklists-1 src /* CrowdSec: lists:otx-webscanners */
29029 1341K DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0 match-set crowdsec-blacklists-0 src /* CrowdSec: CAPI */
Chain DOCKER (13 references)
pkts bytes target prot opt in out source destination
4 240 ACCEPT 6 -- !br-c74cf20edbfa br-c74cf20edbfa 0.0.0.0/0 172.28.0.130 tcp dpt:3306
2 112 ACCEPT 6 -- !br-f61501bed6b3 br-f61501bed6b3 0.0.0.0/0 172.28.1.10 tcp dpt:8080
5 300 ACCEPT 6 -- !br-f61501bed6b3 br-f61501bed6b3 0.0.0.0/0 172.28.1.10 tcp dpt:6060
5 300 ACCEPT 6 -- !br-f61501bed6b3 br-f61501bed6b3 0.0.0.0/0 172.28.1.11 tcp dpt:8082
7911 469K ACCEPT 6 -- !br-f61501bed6b3 br-f61501bed6b3 0.0.0.0/0 172.28.1.11 tcp dpt:443
2368 140K ACCEPT 6 -- !br-f61501bed6b3 br-f61501bed6b3 0.0.0.0/0 172.28.1.11 tcp dpt:80
5 300 ACCEPT 6 -- !br-cdb2612b0396 br-cdb2612b0396 0.0.0.0/0 172.24.2.2 tcp dpt:8080
5 240 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:587
1 40 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:465
117 6940 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:25
0 0 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:8443
0 0 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:8080
0 0 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:12345
2 100 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:4190
3 152 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:995
254 15240 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:993
2 100 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:143
20 1148 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:110
0 0 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.249 tcp dpt:6379
0 0 ACCEPT 6 -- !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.2 tcp dpt:3306
7 420 ACCEPT 6 -- !br-5c6a8473b274 br-5c6a8473b274 0.0.0.0/0 172.24.5.2 tcp dpt:9100
74808 4488K ACCEPT 6 -- !br-9ffc563ab53d br-9ffc563ab53d 0.0.0.0/0 172.24.4.2 tcp dpt:2375
0 0 DROP 0 -- !br-c0b8c7e30d65 br-c0b8c7e30d65 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-0b12ba455b64 br-0b12ba455b64 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-9ffc563ab53d br-9ffc563ab53d 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-de0b75d73338 br-de0b75d73338 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-f61501bed6b3 br-f61501bed6b3 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-25ea171b802f br-25ea171b802f 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-049e2fe8314b br-049e2fe8314b 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-5c6a8473b274 br-5c6a8473b274 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-78a3e4f28440 br-78a3e4f28440 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-c74cf20edbfa br-c74cf20edbfa 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- !br-cdb2612b0396 br-cdb2612b0396 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-BRIDGE (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER 0 -- * br-c0b8c7e30d65 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER 0 -- * br-0b12ba455b64 0.0.0.0/0 0.0.0.0/0
74808 4488K DOCKER 0 -- * br-9ffc563ab53d 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER 0 -- * br-de0b75d73338 0.0.0.0/0 0.0.0.0/0
205K 12M DOCKER 0 -- * br-f61501bed6b3 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER 0 -- * br-25ea171b802f 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER 0 -- * br-049e2fe8314b 0.0.0.0/0 0.0.0.0/0
10 600 DOCKER 0 -- * br-5c6a8473b274 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER 0 -- * br-78a3e4f28440 0.0.0.0/0 0.0.0.0/0
6 360 DOCKER 0 -- * br-c74cf20edbfa 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER 0 -- * docker0 0.0.0.0/0 0.0.0.0/0
404 23960 DOCKER 0 -- * br-mailcow 0.0.0.0/0 0.0.0.0/0
5 300 DOCKER 0 -- * br-cdb2612b0396 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-CT (1 references)
pkts bytes target prot opt in out source destination
102 46167 ACCEPT 0 -- * br-c0b8c7e30d65 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * br-0b12ba455b64 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
759K 48M ACCEPT 0 -- * br-9ffc563ab53d 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * br-de0b75d73338 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
1893K 301M ACCEPT 0 -- * br-f61501bed6b3 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
486 390K ACCEPT 0 -- * br-25ea171b802f 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * br-049e2fe8314b 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
2696K 156M ACCEPT 0 -- * br-5c6a8473b274 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * br-78a3e4f28440 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
2766 1073K ACCEPT 0 -- * br-c74cf20edbfa 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT 0 -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
23836 34M ACCEPT 0 -- * br-mailcow 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
186K 10M ACCEPT 0 -- * br-cdb2612b0396 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
Chain DOCKER-FORWARD (1 references)
pkts bytes target prot opt in out source destination
16M 27G DOCKER-CT 0 -- * * 0.0.0.0/0 0.0.0.0/0
9805K 26G DOCKER-INTERNAL 0 -- * * 0.0.0.0/0 0.0.0.0/0
9805K 26G DOCKER-BRIDGE 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-b22c61cc9628 br-b22c61cc9628 0.0.0.0/0 0.0.0.0/0
100 13656 ACCEPT 0 -- br-c0b8c7e30d65 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-d2a8f59bf25c br-d2a8f59bf25c 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-fdbc8b65ab9e br-fdbc8b65ab9e 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-0b12ba455b64 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-63a8f12f0845 br-63a8f12f0845 0.0.0.0/0 0.0.0.0/0
669K 779M ACCEPT 0 -- br-9ffc563ab53d * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-c2ea9d681c8d br-c2ea9d681c8d 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-de0b75d73338 * 0.0.0.0/0 0.0.0.0/0
2689K 1960M ACCEPT 0 -- br-f61501bed6b3 * 0.0.0.0/0 0.0.0.0/0
622 153K ACCEPT 0 -- br-25ea171b802f * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-049e2fe8314b * 0.0.0.0/0 0.0.0.0/0
5437K 22G ACCEPT 0 -- br-5c6a8473b274 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-78a3e4f28440 * 0.0.0.0/0 0.0.0.0/0
2680 4081K ACCEPT 0 -- br-c74cf20edbfa * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- docker0 * 0.0.0.0/0 0.0.0.0/0
24181 2306K ACCEPT 0 -- br-mailcow * 0.0.0.0/0 0.0.0.0/0
394K 1582M ACCEPT 0 -- br-cdb2612b0396 * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-INTERNAL (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * br-c2ea9d681c8d !172.24.1.128/25 0.0.0.0/0
0 0 DROP 0 -- br-c2ea9d681c8d * 0.0.0.0/0 !172.24.1.128/25
0 0 DROP 0 -- * br-63a8f12f0845 !172.28.0.0/25 0.0.0.0/0
0 0 DROP 0 -- br-63a8f12f0845 * 0.0.0.0/0 !172.28.0.0/25
0 0 DROP 0 -- * br-fdbc8b65ab9e !172.24.1.0/25 0.0.0.0/0
0 0 DROP 0 -- br-fdbc8b65ab9e * 0.0.0.0/0 !172.24.1.0/25
0 0 DROP 0 -- * br-d2a8f59bf25c !172.24.0.128/25 0.0.0.0/0
0 0 DROP 0 -- br-d2a8f59bf25c * 0.0.0.0/0 !172.24.0.128/25
0 0 DROP 0 -- * br-b22c61cc9628 !172.28.2.0/25 0.0.0.0/0
0 0 DROP 0 -- br-b22c61cc9628 * 0.0.0.0/0 !172.28.2.0/25
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
16M 27G CROWDSEC_CHAIN 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain MAILCOW (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP 6 -- !br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0 /* mailcow isolation */Logs of ip6tables -L -vn:
Chain INPUT (policy ACCEPT 1827K packets, 3783M bytes)
pkts bytes target prot opt in out source destination
1827K 3783M MAILCOW 0 -- * * ::/0 ::/0 /* mailcow */
1827K 3783M MAILCOW 0 -- * * ::/0 ::/0 /* mailcow */
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1484 310K MAILCOW 0 -- * * ::/0 ::/0 /* mailcow */
1484 310K MAILCOW 0 -Source: mailcow/mailcow-dockerized