Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved pfSense Packages
    855 Posts 136 Posters 1.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      You can set your internal mail servers on ACLs -> Client Access List, but I don't know if postscreen('zombie blocker') or rbl checks can validade internal mail servers.

      You can check other postfix antispam features with 'strong header verification' and ACLs for filter header,MIME and body settings.

      For a deep internal mail server antispam search you may need mailscanner.
      I'm working on this package now and will be available soon.

      best regards,
      Marcello Coutinho

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • M
        mauricioniñoavella
        last edited by

        how to do my main.cf configuracuion if I have it in centos bit too high I want to pass this pfSense this is my main.cf I want to enable in pfsnese

        thanks for the collaboration

        General settings

        bounce_queue_lifetime = 6h
        mailbox_size_limit = 51200000
        message_size_limit = 10240000
        luser_relay =
        recipient_delimiter = +
        message_strip_characters = \0

        Authentication with SASL

        broken_sasl_auth_clients = yes
        smtpd_sasl_auth_enable = yes
        smtpd_sasl_security_options = noanonymous
        smtpd_sasl_local_domain = $mydomain

        Encryption with TLS

        smtpd_tls_auth_only = yes

        smtpd_use_tls = yes
        smtpd_tls_cert_file = /etc/postfix/cert.pem
        smtpd_tls_key_file = /etc/postfix/key.pem
        smtpd_tls_loglevel = 1

        Mail restrictions (note: Kolab policies are not implemented)

        smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
        kolabpolicy_time_limit = 3600
        kolabpolicy_max_idle = 20

        Mail routing

        mailbox_transport = mailpostfilter
        content_filter = mailprefilter
        transport_maps = hash:/etc/postfix/transport

        Outbound SMTP authentication

        smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
        smtp_sasl_auth_enable = yes
        smtp_sasl_security_options =
        unknown_local_recipient_reject_code = 550
        smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
        smtp_tls_security_level = may
        smtp_sasl_type = cyrus
        relayhost = [xxxx.com]:587

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          You can put your options on custom main.cf options at gui.

          This package was designed to be a relay server only, I do not recomend enabling mailboxes on it.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • M
            mauricioniñoavella
            last edited by

            I just want it to pass and I get this

            postfix/smtpd[50880]: NOQUEUE: reject: RCPT from unknown[192.168.200.xxx]: 554 5.7.1 mauricio.nino@xxx.com.co: Relay access denied; from= root@localhost.localdomainto= mauricio.nino@xxx.com.coproto=ESMTP helo=<localhost.localdomain></localhost.localdomain>/mauricio.nino@xxx.com.co/root@localhost.localdomain/mauricio.nino@xxx.com.co

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              Include your 192.168.200.xxx internal ip in ACL/fiter map.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • M
                mauricioniñoavella
                last edited by

                marcelloc

                appreciate your help but I do not work I have this in the log

                The truth can not be done now, I only serve as a relay,

                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=check_client_access
                Oct 11 16:49:45 postfix/smtpd[29361]: check_namadr_access: name unknown addr 192.168.200.14
                Oct 11 16:49:45 postfix/smtpd[29361]: check_domain_access: unknown
                Oct 11 16:49:45 postfix/smtpd[29361]: dict_cidr_lookup: /usr/local/etc/postfix/cal_cidr: unknown
                Oct 11 16:49:45 postfix/smtpd[29361]: check_addr_access: 192.168.200.14
                Oct 11 16:49:45 postfix/smtpd[29361]: dict_cidr_lookup: /usr/local/etc/postfix/cal_cidr: 192.168.200.14
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=check_client_access status=0
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit status=1
                Oct 11 16:49:45 postfix/smtpd[29361]: >>> START Helo command RESTRICTIONS <<<
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_helo_hostname
                Oct 11 16:49:45 postfix/smtpd[29361]: reject_unknown_hostname: localhost.localdomain
                Oct 11 16:49:45 postfix/smtpd[29361]: lookup localhost.localdomain type A flags 0
                Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (A): OK
                Oct 11 16:49:45 postfix/smtpd[29361]: dns_get_answer: type A for localhost.localdomain
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_helo_hostname status=0
                Oct 11 16:49:45 postfix/smtpd[29361]: >>> END Helo command RESTRICTIONS <<<
                Oct 11 16:49:45 postfix/smtpd[29361]: >>> START Sender address RESTRICTIONS <<<
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_sender_domain
                Oct 11 16:49:45 postfix/smtpd[29361]: reject_unknown_address: root@localhost.localdomain
                Oct 11 16:49:45 postfix/smtpd[29361]: ctable_locate: move existing entry key root@localhost.localdomain
                Oct 11 16:49:45 postfix/smtpd[29361]: reject_unknown_mailhost: localhost.localdomain
                Oct 11 16:49:45 postfix/smtpd[29361]: lookup localhost.localdomain type MX flags 0
                Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (MX): Host not found
                Oct 11 16:49:45 postfix/smtpd[29361]: lookup localhost.localdomain type A flags 0
                Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (A): OK
                Oct 11 16:49:45 postfix/smtpd[29361]: dns_get_answer: type A for localhost.localdomain
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_sender_domain status=0
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit status=1
                Oct 11 16:49:45 postfix/smtpd[29361]: >>> START Recipient address RESTRICTIONS <<<
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unauth_destination
                Oct 11 16:49:45 postfix/smtpd[29361]: reject_unauth_destination: mauricio.nino@xxxx.com.co
                Oct 11 16:49:45 postfix/smtpd[29361]: permit_auth_destination: mauricio.nino@xxxx.com.co
                Oct 11 16:49:45 postfix/smtpd[29361]: ctable_locate: move existing entry key mauricio.nino@xxxx.com.co
                Oct 11 16:49:45 postfix/smtpd[29361]: NOQUEUE: reject: RCPT from unknown[192.168.200.14]: 554 5.7.1 mauricio.nino@itac.com.co: Relay access denied; from= root@localhost.localdomainto= mauricio.nino@xxx.com.coproto=ESMTP helo=<localhost.localdomain></localhost.localdomain>/mauricio.nino@xxx.com.co/root@localhost.localdomain/mauricio.nino@itac.com.co
                Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unauth_destination status=2
                Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 554 5.7.1 mauricio.nino@xxxx.com.co: Relay access denied
                Oct 11 16:49:45 postfix/smtpd[29361]: watchdog_pat: 0x800e115f0
                Oct 11 16:49:45 postfix/smtpd[29361]: < unknown[192.168.200.14]: DATA
                Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 554 5.5.1 Error: no valid recipients
                Oct 11 16:49:45 postfix/smtpd[29361]: watchdog_pat: 0x800e115f0
                Oct 11 16:49:45 postfix/smtpd[29361]: < unknown[192.168.200.14]: RSET
                Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 250 2.0.0 Ok
                Oct 11 16:49:45 postfix/smtpd[29361]: watchdog_pat: 0x800e115f0
                Oct 11 16:49:45 postfix/smtpd[29361]: < unknown[192.168.200.14]: QUIT
                Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 221 2.0.0 Bye
                Oct 11 16:49:45 postfix/smtpd[29361]: match_hostname: unknown ~? 192.168.200.0/23
                Oct 11 16:49:45 postfix/smtpd[29361]: match_hostaddr: 192.168.200.14 ~? 192.168.200.0/23
                Oct 11 16:49:45 postfix/smtpd[29361]: disconnect from unknown[192.168.200.14]

                ![postfix relay.png_thumb](/public/imported_attachments/1/postfix relay.png_thumb)
                ![postfix relay.png](/public/imported_attachments/1/postfix relay.png)/mauricio.nino@xxxx.com.co

                1 Reply Last reply Reply Quote 0
                • J
                  jedblack
                  last edited by

                  marcelloc,

                  Thanks for all the hard work!

                  I have one question…

                  can i use the postfix forwarder to forward my mail to GMAIL server... i'm doing this now with a centos/postfix install... below is the pertinent config file entries..

                  SASL authentication

                  smtp_tls_security_level=encrypt
                  smtp_sasl_auth_enable = yes
                  smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
                  smtp_sasl_security_options = noanonymous
                  relayhost = [smtp.gmail.com]:587
                  transport_maps = hash:/etc/postfix/transport

                  TLS

                  smtp_tls_CAfile = /etc/postfix/cacert.pem
                  smtp_tls_cert_file = /etc/postfix/certs/git01.pem
                  smtp_tls_key_file = /etc/postfix/certs/git01.key
                  smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache
                  smtp_use_tls = yes
                  smtpd_tls_CAfile = /etc/postfix/cacert.pem
                  smtpd_tls_cert_file = /etc/postfix/certs/git01.pem
                  smtpd_tls_key_file = /etc/postfix/certs/git01.key
                  smtpd_tls_received_header = yes
                  smtpd_tls_session_cache_database = btree:/var/run/smtpd_tls_session_cache
                  smtpd_use_tls = yes
                  smtp_tls_loglevel = 1
                  tls_random_source = dev:/dev/urandom
                  smtp_cname_overrides_servername = no
                  #debug_peer_list=smtp.gmail.com
                  #debug_peer_level=3

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    Did you tried to include your config in custom main.cf options and of course transfer your files to pfsense?

                    I'm not sure if other options will affect you setup but could work.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @mauricioniñoavella:

                      marcelloc
                      Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (MX): Host not found
                      Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (A): OK
                      Oct 11 16:49:45 postfix/smtpd[29361]: dns_get_answer: type A for localhost.localdomain
                      Oct 11 16:49:45 postfix/smtpd[29361]: NOQUEUE: reject: RCPT from unknown[192.168.200.14]: 554 5.7.1 mauricio.nino@itac.com.co: Relay access denied; from= root@localhost.localdomainto= mauricio.nino@itac.com.coproto=ESMTP helo=<localhost.localdomain></localhost.localdomain>/mauricio.nino@itac.com.co/root@localhost.localdomain/mauricio.nino@itac.com.co
                      Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unauth_destination status=2
                      Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 554 5.5.1 Error: no valid recipients

                      mauricioniñoavella,

                      see what postfix is rejecting and correct it.
                      It looks like you tried to send a email with an invalid sender.
                      If you need this sender, create this domain in dns server that pfsense uses.

                      att,
                      Marcello Coutinho

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • M
                        mauricioniñoavella
                        last edited by

                        marcelloc

                        greeting
                        I tried to do everything

                        Current issue if tusabes Nose to issue

                        generates this error since I only use smtp_sasl

                        mailserver postfix/smtpd[20836]: warning: smtpd_sasl_auth_enable is true, but SASL support is not compiled in
                        mailserver postfix/smtpd[20836]: connect from unknown[xxxx.xxxx.xxxx.xxx]
                        mailserver postfix/smtpd[20836]: disconnect from unknown[xxxx.xxxx.xxxx.xxx]

                        I hit it in the

                        custom main.cf options

                        smtp_sasl_auth_enable = yes
                        smtp_sasl_password_maps = hash:/usr/local/etc/postfix/sasl_passwd
                        smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
                        relayhost = [smtp.xxx.com]:587

                        thanks for your collaboration

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          Seems that many people need SASL auth, I will put in postfix forwarder TODO list.

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • M
                            mauricioniñoavella
                            last edited by

                            Too bad I could bother you confirm if it works as a relay Services: Postfix relay and antispam (postfix forwarder) and also worked with
                            STARTTLS

                            thanks for your collaboration

                            1 Reply Last reply Reply Quote 0
                            • D
                              darklogic
                              last edited by

                              Hello,

                              I must say I am glad to see this package. Mail proxies and mail forwarders with filtering is a must have these days. I am new to this package and was wondering if there is any documentation on how to configure and set it up for use. Some of the setting are unclear to me.

                              I am not sure what the binding setting is for the WAN, LAN, and loopback and can't find anything that explains it better or what basic settings should be set to. Also, when I removed my SMTP port forward form NAT and rules to use this package, I am having trouble recieving mails. I went to mxtoolbox.com and did a diagnostics test and I don't get a header response or anything. It just says host times out from inactivity.

                              I really did not change any of the default setting from the install and yes I did add the domain with a forwarding internal address.

                              Could someone help or post a basic setup that would get this working. It is a little hard to figure settings with no documentation or explinations of settings.

                              Thanks,

                              MDP

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                at docs.pfsense.com has some info but not so detailed.

                                the basic setup is:

                                • remove nat from port 25

                                • create a wan rule to permit smtp traffic to wan address

                                • check enable postfix option

                                • choose at least wan loopback interfaces

                                • fill your domain/internal smtp info

                                Many options has recommend, default and link option to postfix documentation.

                                I recommend enable all antispam settings too.

                                att,
                                Marcello Coutinho

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • D
                                  darklogic
                                  last edited by

                                  Hey thanks very much for the info. I will give a try. I really like the concept of this package and have waited a while to see something like this come out for pfsense, so thanks for all your hard work.

                                  I do have one question for your response. When you say WAN loopback interface, do you mean select the WAN interface only, the loopback interface only, or both?

                                  Thanks Again,

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    darklogic
                                    last edited by

                                    So I have e-mails forwarding ok now and thanks for the basic info for that. Just curious, as I seen in early to mid last month a post you made about mailscanner, and was wondering if this will become part of the base install of the postfix forwarder package?

                                    Currently I am unsure how to implement this ability and not really sure on what the ACLs/Filter maps tab does.

                                    If you made this package an all inclusive install with all the components needed for a full SMTP filter, that would be sweet.

                                    Thanks

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      Mailscanner + spamassassin will be released soon as a new package with more then 500 options to filter spam. As I told in other posts, I'm waiting Mailscanner package compilation by core team. But if you know how mailscanner works you can add freebsd package and configure it.

                                      Can you feedback in % how postfix + all antispam settings reduced spam messages on mailboxes?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        darklogic
                                        last edited by

                                        Yeah, I will post some stats in a about a week. I will compare report files from our other filtering system and see what a rough % in reduction maybe. I can say that I have noticed a difference already just from last night when I enabled it. I am seeing a lot of RBLS blocks and invalide host address blocks. Normally this would get cought by our other filter, but not always for some reason.

                                        For the most part, it seems to be working very well and I am excited for the Mailscanner package.

                                        I have been playing around with the ACLs/Filter Maps section and was wondering if a manual blacklist block and whitelist allow will be added?

                                        Thanks,

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          The ACLs allow you to block or permit ips, subjects, atachments and Also filter message body.

                                          Take a look at samples below each field.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            darklogic
                                            last edited by

                                            Ahhh yes, I am starting to understand how you are laying this out. This all makes sense now. I guess I have just been getting to use to check boxes and enable buttons way to much LOL.

                                            Thanks again for the info.

                                            Take Care

                                            MDP

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.