Protonmail-bridge is unusable from the public internet

[moozhub]

Protonmail-bridge will only bind to 127.0.0.1, which will only accept connections from localhost and not ideal for setting up accounts on other clients either on your local network or from the public internet. I've successfully connected from the public internet using a TCP binding tool like socat which will forward connections from a bound internal IP to 127.0.0.1 and was able to browse my email without issues, but this isn't exactly a practical setup. Are there any plans to allow the bridge to be configured to listen on specific internal IP addresses or interfaces?

[horejsek]

Hi. Binding on localhost only is actually intended behaviour. Allowing bridge to listen to any interface is dangerous as if your bridge password would be leaked, anyone would be able to read your messages. We don't want to ship Bridge with listening to any interface nor we want to provide option to change it. Savvy users can use socat like you did to make it work and such user would also know what they are doing and can know what else to setup to make the connection to the Bridge secure enough.

[bartbutler]

That said, we do want to make a headless bridge at some point to be able to act as an SMTP/IMAP gateway for integrations. It will not be a consumer GUI app though and there is no timeline.

[deslee]

My use case is to run proton-bridge on my internal private network which is inaccessible from the internet. I acknowledge that it's not as secure. That said, it's pretty easy to change the bind address and rebuild for those who are interested: https://github.com/deslee/proton-bridge/commit/1eb07d21aff97e8f88bca821108f53c35a49c9c8

[Noah-Huppert]

For anyone else who arrived here from the PR:

I was trying to migrate off ProtonMail and found the lack of an externally accessible IMAP server to be a source of lock in¹. Preventing me from using the readily available migration service that Google Workspace provides for pulling emails from your old provider into your new accounts.

I followed the theme of the PR and produced the following resources and instruction to temporarily run ProtonMail Bridge in a publically accessible manner so Google Workspaces data migration tool can be used: https://github.com/Noah-Huppert/funkyboy.zone/tree/40d392b56ed9b7160dd44563a18ce71eb6f7c9cc/kubernetes/base/protonmail-bridge

¹Although ProtonMail provides your emails as .eml files Google Workspaces doesn't natively support importing these files