Fronting mailpit with AWS NLB running in k8s

[pureiboi]

Hi,

Wonder if anyone had a similar setup using MailPit?

Currently, I'm running MailPit service in AWS EKS

the flow
client -> nlb -> eks pod

Strange enough the mailpit works if i do port-forward, while it is not working when traffic starts from nlb

Edit:

Looks like I'm missing out on some critical information on the setup.

This perfectly working

client -> nlb -> MailPit (eks pod)

After further investigation of the setup I have. Looks like it's an issue with Linkerd unable to forward the request to the downstream service.

While it's not issue due to MailPit, I'm still curious if anyone actually set it up this way.

[pureiboi]

Finally figured out that linkerd proxy is blocking the traffic becos of the protocol detection,

[axllent]

No worry, I'm not familiar with that setup so I can't comment. So what you are saying is that the proxy is failing to relay the SMTP connections (either in or our, or potentially both)?

[janquijano]

It does not work for both Proxy protocol on or off. It could be something else. I will update this thread with findings. We are till checking this with AWS support.

I'd like to say though that we have been using mailpit for years now and are very much happy with it. So thank you! Now requirements just changed and we need to expose the smtp service to the internet.

[axllent]

I'm glad to hear you are happy with Mailpit! If you do discover the issue and can provide me with some guidance as to what I would need to change to make this work (assuming it is in fact a Mailpit issue) then please just let me know. I'm not an AWS user, so I am strongly relying on your expertise here 👍

[pureiboi]

@janquijano wonder what port is exposed?

If you happened to use port 25, it's been blocked by AWS by default https://repost.aws/knowledge-center/ec2-port-25-throttle

[janquijano]

so the issue was our internal firewall was blocking the packets after SYN/SYN ACK. Telnet works but you don't get the banner message.

You should get this result with telnet with banner message.

The default NLB configuration of Proxy Protocl=OFF and Preserve Client IP=ON is just fine.