Postfix - antispam and relay package

mauricioniñoavella

marcelloc

appreciate your help but I do not work I have this in the log

The truth can not be done now, I only serve as a relay,

Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=check_client_access
Oct 11 16:49:45 postfix/smtpd[29361]: check_namadr_access: name unknown addr 192.168.200.14
Oct 11 16:49:45 postfix/smtpd[29361]: check_domain_access: unknown
Oct 11 16:49:45 postfix/smtpd[29361]: dict_cidr_lookup: /usr/local/etc/postfix/cal_cidr: unknown
Oct 11 16:49:45 postfix/smtpd[29361]: check_addr_access: 192.168.200.14
Oct 11 16:49:45 postfix/smtpd[29361]: dict_cidr_lookup: /usr/local/etc/postfix/cal_cidr: 192.168.200.14
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=check_client_access status=0
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit status=1
Oct 11 16:49:45 postfix/smtpd[29361]: >>> START Helo command RESTRICTIONS <<<
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_helo_hostname
Oct 11 16:49:45 postfix/smtpd[29361]: reject_unknown_hostname: localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: lookup localhost.localdomain type A flags 0
Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (A): OK
Oct 11 16:49:45 postfix/smtpd[29361]: dns_get_answer: type A for localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_helo_hostname status=0
Oct 11 16:49:45 postfix/smtpd[29361]: >>> END Helo command RESTRICTIONS <<<
Oct 11 16:49:45 postfix/smtpd[29361]: >>> START Sender address RESTRICTIONS <<<
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_sender_domain
Oct 11 16:49:45 postfix/smtpd[29361]: reject_unknown_address: root@localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: ctable_locate: move existing entry key root@localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: reject_unknown_mailhost: localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: lookup localhost.localdomain type MX flags 0
Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (MX): Host not found
Oct 11 16:49:45 postfix/smtpd[29361]: lookup localhost.localdomain type A flags 0
Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (A): OK
Oct 11 16:49:45 postfix/smtpd[29361]: dns_get_answer: type A for localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unknown_sender_domain status=0
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=permit status=1
Oct 11 16:49:45 postfix/smtpd[29361]: >>> START Recipient address RESTRICTIONS <<<
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unauth_destination
Oct 11 16:49:45 postfix/smtpd[29361]: reject_unauth_destination: mauricio.nino@xxxx.com.co
Oct 11 16:49:45 postfix/smtpd[29361]: permit_auth_destination: mauricio.nino@xxxx.com.co
Oct 11 16:49:45 postfix/smtpd[29361]: ctable_locate: move existing entry key mauricio.nino@xxxx.com.co
Oct 11 16:49:45 postfix/smtpd[29361]: NOQUEUE: reject: RCPT from unknown[192.168.200.14]: 554 5.7.1 mauricio.nino@itac.com.co: Relay access denied; from= root@localhost.localdomainto= mauricio.nino@xxx.com.coproto=ESMTP helo=<localhost.localdomain></localhost.localdomain>/mauricio.nino@xxx.com.co /root@localhost.localdomain /mauricio.nino@itac.com.co
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unauth_destination status=2
Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 554 5.7.1 mauricio.nino@xxxx.com.co: Relay access denied
Oct 11 16:49:45 postfix/smtpd[29361]: watchdog_pat: 0x800e115f0
Oct 11 16:49:45 postfix/smtpd[29361]: < unknown[192.168.200.14]: DATA
Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 554 5.5.1 Error: no valid recipients
Oct 11 16:49:45 postfix/smtpd[29361]: watchdog_pat: 0x800e115f0
Oct 11 16:49:45 postfix/smtpd[29361]: < unknown[192.168.200.14]: RSET
Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 250 2.0.0 Ok
Oct 11 16:49:45 postfix/smtpd[29361]: watchdog_pat: 0x800e115f0
Oct 11 16:49:45 postfix/smtpd[29361]: < unknown[192.168.200.14]: QUIT
Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 221 2.0.0 Bye
Oct 11 16:49:45 postfix/smtpd[29361]: match_hostname: unknown ~? 192.168.200.0/23
Oct 11 16:49:45 postfix/smtpd[29361]: match_hostaddr: 192.168.200.14 ~? 192.168.200.0/23
Oct 11 16:49:45 postfix/smtpd[29361]: disconnect from unknown[192.168.200.14]

![postfix relay.png_thumb](/public/imported_attachments/1/postfix relay.png_thumb)
![postfix relay.png](/public/imported_attachments/1/postfix relay.png)/mauricio.nino@xxxx.com.co

jedblack

marcelloc,

Thanks for all the hard work!

I have one question…

can i use the postfix forwarder to forward my mail to GMAIL server... i'm doing this now with a centos/postfix install... below is the pertinent config file entries..

SASL authentication

smtp_tls_security_level=encrypt
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
relayhost = [smtp.gmail.com]:587
transport_maps = hash:/etc/postfix/transport

TLS

smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_tls_cert_file = /etc/postfix/certs/git01.pem
smtp_tls_key_file = /etc/postfix/certs/git01.key
smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache
smtp_use_tls = yes
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_cert_file = /etc/postfix/certs/git01.pem
smtpd_tls_key_file = /etc/postfix/certs/git01.key
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:/var/run/smtpd_tls_session_cache
smtpd_use_tls = yes
smtp_tls_loglevel = 1
tls_random_source = dev:/dev/urandom
smtp_cname_overrides_servername = no
#debug_peer_list=smtp.gmail.com
#debug_peer_level=3

marcelloc

Did you tried to include your config in custom main.cf options and of course transfer your files to pfsense?

I'm not sure if other options will affect you setup but could work.

marcelloc

@mauricioniñoavella:

marcelloc
Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (MX): Host not found
Oct 11 16:49:45 postfix/smtpd[29361]: dns_query: localhost.localdomain (A): OK
Oct 11 16:49:45 postfix/smtpd[29361]: dns_get_answer: type A for localhost.localdomain
Oct 11 16:49:45 postfix/smtpd[29361]: NOQUEUE: reject: RCPT from unknown[192.168.200.14]: 554 5.7.1 mauricio.nino@itac.com.co: Relay access denied; from= root@localhost.localdomainto= mauricio.nino@itac.com.coproto=ESMTP helo=<localhost.localdomain></localhost.localdomain>/mauricio.nino@itac.com.co /root@localhost.localdomain /mauricio.nino@itac.com.co
Oct 11 16:49:45 postfix/smtpd[29361]: generic_checks: name=reject_unauth_destination status=2
Oct 11 16:49:45 postfix/smtpd[29361]: > unknown[192.168.200.14]: 554 5.5.1 Error: no valid recipients

mauricioniñoavella,

see what postfix is rejecting and correct it.
It looks like you tried to send a email with an invalid sender.
If you need this sender, create this domain in dns server that pfsense uses.

att,
Marcello Coutinho

mauricioniñoavella

marcelloc

greeting
I tried to do everything

Current issue if tusabes Nose to issue

generates this error since I only use smtp_sasl

mailserver postfix/smtpd[20836]: warning: smtpd_sasl_auth_enable is true, but SASL support is not compiled in
mailserver postfix/smtpd[20836]: connect from unknown[xxxx.xxxx.xxxx.xxx]
mailserver postfix/smtpd[20836]: disconnect from unknown[xxxx.xxxx.xxxx.xxx]

I hit it in the

custom main.cf options

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/usr/local/etc/postfix/sasl_passwd
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
relayhost = [smtp.xxx.com]:587

thanks for your collaboration

marcelloc

Seems that many people need SASL auth, I will put in postfix forwarder TODO list.

mauricioniñoavella

Too bad I could bother you confirm if it works as a relay Services: Postfix relay and antispam (postfix forwarder) and also worked with
STARTTLS

thanks for your collaboration

darklogic

Hello,

I must say I am glad to see this package. Mail proxies and mail forwarders with filtering is a must have these days. I am new to this package and was wondering if there is any documentation on how to configure and set it up for use. Some of the setting are unclear to me.

I am not sure what the binding setting is for the WAN, LAN, and loopback and can't find anything that explains it better or what basic settings should be set to. Also, when I removed my SMTP port forward form NAT and rules to use this package, I am having trouble recieving mails. I went to mxtoolbox.com and did a diagnostics test and I don't get a header response or anything. It just says host times out from inactivity.

I really did not change any of the default setting from the install and yes I did add the domain with a forwarding internal address.

Could someone help or post a basic setup that would get this working. It is a little hard to figure settings with no documentation or explinations of settings.

Thanks,

MDP

marcelloc

at docs.pfsense.com has some info but not so detailed.

the basic setup is:

remove nat from port 25
create a wan rule to permit smtp traffic to wan address
check enable postfix option
choose at least wan loopback interfaces
fill your domain/internal smtp info

Many options has recommend, default and link option to postfix documentation.

I recommend enable all antispam settings too.

att,
Marcello Coutinho

darklogic

Hey thanks very much for the info. I will give a try. I really like the concept of this package and have waited a while to see something like this come out for pfsense, so thanks for all your hard work.

I do have one question for your response. When you say WAN loopback interface, do you mean select the WAN interface only, the loopback interface only, or both?

Thanks Again,

darklogic

So I have e-mails forwarding ok now and thanks for the basic info for that. Just curious, as I seen in early to mid last month a post you made about mailscanner, and was wondering if this will become part of the base install of the postfix forwarder package?

Currently I am unsure how to implement this ability and not really sure on what the ACLs/Filter maps tab does.

If you made this package an all inclusive install with all the components needed for a full SMTP filter, that would be sweet.

Thanks

marcelloc

Mailscanner + spamassassin will be released soon as a new package with more then 500 options to filter spam. As I told in other posts, I'm waiting Mailscanner package compilation by core team. But if you know how mailscanner works you can add freebsd package and configure it.

Can you feedback in % how postfix + all antispam settings reduced spam messages on mailboxes?

darklogic

Yeah, I will post some stats in a about a week. I will compare report files from our other filtering system and see what a rough % in reduction maybe. I can say that I have noticed a difference already just from last night when I enabled it. I am seeing a lot of RBLS blocks and invalide host address blocks. Normally this would get cought by our other filter, but not always for some reason.

For the most part, it seems to be working very well and I am excited for the Mailscanner package.

I have been playing around with the ACLs/Filter Maps section and was wondering if a manual blacklist block and whitelist allow will be added?

Thanks,

marcelloc

The ACLs allow you to block or permit ips, subjects, atachments and Also filter message body.

Take a look at samples below each field.

darklogic

Ahhh yes, I am starting to understand how you are laying this out. This all makes sense now. I guess I have just been getting to use to check boxes and enable buttons way to much LOL.

Thanks again for the info.

Take Care

MDP

mauricioniñoavella

hello

marcelloc

I can confirm you this module can function as a relay host, thatis I work as an SMTP forwarder to an external mail Server using STARTTLS

I congratulate you for your great support for this great pauqete, Proxies and redirects mail, I'm new in this package I would like know if there is some configuration information, as a forwarder (SMTP) mail to an external Server "Outbound Relay Hosts"

Could anyone help me with the basic configuration to work as mail forwarder to an external server authentication through a little priest specified. It's a bit difficult to understand the configuration without documentation or configuration give some tics.

thanks for your collaboration

marcelloc

mauricioniñoavella,

The basic setup is already in this topic.
http://forum.pfsense.org/index.php/topic,40622.msg217539.html#msg217539

All features in postfix forwarder package was include after many hours reading official postfix documentation.

Many features in this packages, has samples or direct links to postfix website, take a look.

Also you have the options to see the result of gui setup in View confi files tab.

Some docs about SASL say that are many implementations for it in postfix, now I'm trying to find one compatible with pfsense.

see considerations on enabling TLS
http://www.postfix.org/TLS_README.html

darklogic

marcelloc

I have a e-mail that seems to be getting blocked, which I think is a false positive. Here is the log I get back. Note that I removed the actual domain name and IP.

postfix/smtpd[32719]: NOQUEUE: reject: RCPT from mail.example.org[XXX.XXX.XXX.XXX]: 450 4.7.1 <ex02.example.local>: Helo command rejected: Host not found; from= someone@example.orgto= someone@mydomain.comproto=ESMTP helo= <ex02.example.local>I added this filter rule in the header to allow. This did not seem to work, but when I added a different rule to REJECT a different domain name, it worked.

/^From:.*@example.org/ OK

Any idea on this?

Thanks,

MDP</ex02.example.local>/someone@mydomain.com /someone@example.org</ex02.example.local>

marcelloc

The host that remote server announce on Helo smtp command Does not exist.

This is one of the header verification tests.

marcelloc

Hi all,

Postfix compilation on x64 now includes cyrus-SASL2 and TLS.

who need or want to test it, reinstall or remove/install postfix package.

No changes in gui for this option. Include all your SASL and/or TLS config in custom main.cf options

att,
Marcello Coutinho