From 7b658fa65c0125a23d401d03557fdf11a5b0278c Mon Sep 17 00:00:00 2001 From: Philipp Harms Date: Fri, 2 Oct 2026 18:45:20 +0200 Subject: [PATCH] [Update] Fix update.sh deleting mailcow's own MASQUERADE rule The "Checking for conflicting bridges" step extracts the bridge name with `cut -d':' -f2`, which yields " br-mailcow" (leading space). Since the variable got quoted in `grep -v "${MAILCOW_BRIDGE}"`, the leading space is significant and never matches "!br-mailcow" in the `iptables -L` output, so the rule `-s .0/24 ! -o br-mailcow -j MASQUERADE` itself gets deleted. The mailcow network loses outbound NAT, unbound turns unhealthy and dependent containers stay in "Created" until Docker is restarted. Strip whitespace/quotes from the bridge name, match the interface as a whole token, and skip the cleanup if the bridge name could not be determined. --- update.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/update.sh b/update.sh index 3e53d2134..02d204db7 100755 --- a/update.sh +++ b/update.sh @@ -374,10 +374,12 @@ if ! $COMPOSE_COMMAND config -q; then fi echo -e "\e[32mChecking for conflicting bridges...\e[0m" -MAILCOW_BRIDGE=$($COMPOSE_COMMAND config | grep -i com.docker.network.bridge.name | cut -d':' -f2) -while read NAT_ID; do - iptables -t nat -D POSTROUTING "$NAT_ID" -done < <(iptables -L -vn -t nat --line-numbers | grep "$IPV4_NETWORK" | grep -E 'MASQUERADE.*all' | grep -v "${MAILCOW_BRIDGE}" | cut -d' ' -f1) +MAILCOW_BRIDGE=$($COMPOSE_COMMAND config | grep -i com.docker.network.bridge.name | cut -d':' -f2 | tr -d "[:space:]\"'") +if [[ -n "${MAILCOW_BRIDGE}" ]]; then + while read NAT_ID; do + iptables -t nat -D POSTROUTING "$NAT_ID" + done < <(iptables -L -vn -t nat --line-numbers | grep "$IPV4_NETWORK" | grep -E 'MASQUERADE.*all' | grep -vE "[[:space:]]!?${MAILCOW_BRIDGE}[[:space:]]" | cut -d' ' -f1) +fi DIFF_DIRECTORY=update_diffs DIFF_FILE=${DIFF_DIRECTORY}/diff_before_update_$(date +"%Y-%m-%d-%H-%M-%S")