Route Migadu SMTP relay traffic through VPS, not VPN #179

New issue

Open

opened 2026-08-27 11:48:52 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-27 11:48:52 -04:00

Owner

Confirmed while diagnosing:

The flagged IP (2001:41d0:203:375::1a) was an OVH-hosted Proton node, not this host's ISP IP or the VPS.
Migadu's own filter cited that connecting IP directly in the quarantine reason — using Migadu as the relay does not exempt outbound mail from IP-reputation checks, contrary to assumption.
The VPS's own IP (66.135.18.105, Vultr) is currently clean on Spamhaus ZEN.

Fix direction

Route the SMTP-to-Migadu hop through the VPS instead of the VPN tunnel, using a private WireGuard tunnel + NAT masquerade (preferred over standing up a Postfix smarthost relay on the VPS — keeps the Migadu credential confined to the home network instead of copying it onto the public-facing box). Whichever shape it takes, it should stay off the open internet — not exposed as a public listener — so it doesn't need to lean on the new CrowdSec edge bouncer for protection.

Scope narrowly: only SMTP-destined traffic should move off the VPN path. Everything else stays on ProtonVPN as-is.

Blocked on

Waiting on the VPS overhaul so this gets built on the Quadlet pattern once, rather than as a bare ad-hoc setup now:

Debian 13 rebuild
frps + firewall bouncer moved into Podman Quadlet
Gatus (status page)
CrowdSec bouncer enforcing decisions at the VPS edge

No urgency otherwise — this only affects non-critical notification mail so far.

Forgejo (and the other Migadu-SMTP services — Authelia, Vaultwarden, Seerr, CWA) send outbound mail through this host's default route, which is ProtonVPN's kill-switch tunnel (`ip rule`/fwmark-based, all non-excluded traffic gets forced through `proton0`/`ipv6leakintrf0`). Proton's exit IPs are shared and rotate; one landed on Spamhaus ZEN on 2026-08-27 and Migadu quarantined a Forgejo → Renovate notification email as a result. Confirmed while diagnosing: - The flagged IP (`2001:41d0:203:375::1a`) was an OVH-hosted Proton node, not this host's ISP IP or the VPS. - Migadu's own filter cited that connecting IP directly in the quarantine reason — using Migadu as the relay does not exempt outbound mail from IP-reputation checks, contrary to assumption. - The VPS's own IP (`66.135.18.105`, Vultr) is currently clean on Spamhaus ZEN. ## Fix direction Route the SMTP-to-Migadu hop through the VPS instead of the VPN tunnel, using a private WireGuard tunnel + NAT masquerade (preferred over standing up a Postfix smarthost relay on the VPS — keeps the Migadu credential confined to the home network instead of copying it onto the public-facing box). Whichever shape it takes, it should stay off the open internet — not exposed as a public listener — so it doesn't need to lean on the new CrowdSec edge bouncer for protection. Scope narrowly: only SMTP-destined traffic should move off the VPN path. Everything else stays on ProtonVPN as-is. ## Blocked on Waiting on the VPS overhaul so this gets built on the Quadlet pattern once, rather than as a bare ad-hoc setup now: 1. Debian 13 rebuild 2. frps + firewall bouncer moved into Podman Quadlet 3. Gatus (status page) 4. CrowdSec bouncer enforcing decisions at the VPS edge No urgency otherwise — this only affects non-critical notification mail so far.

mysticalsoap added the

vps

general-admin

on-hold

labels

2026-08-27 11:48:52 -04:00