[BUG] Default config creates a open relay on baremetal about helm-charts

[micw]

Hello,
nginx is used smtp/imap/pop3. It preserves the originating IP. I run exactly this setup and it's not an open relay. Check that the original IP is in nginx logs. If not, your k8s setup is somehow broken.

[yelhouti]

@micw which CNI are using? Maybe the problem is specific to flannel.

[yelhouti]

@micw the problems seems to happen when kube-proxy is configured with iptables mode instead of ipvs. don't know if we have a way to prevent that, but we should definitely document it and tell people how to test if they operate an open relay. since this can severely impact IP/RANGE score...

[micw]

I use canal with default setup (as provided by rancher2).
If your CNI makes your pods see internal IPs for external traffic, it should be considered seriously broken. With mail, you see consequences very directly (spam, bad reputation) but such an issue would also affect other services that rely on ip information (e.g. any rate-limiting stuff, session security of several applications).

Nevertheless, IMO that's not a bug in mailu or the helm chart. It needs to be fixed in the CNI config.