Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved pfSense Packages
    855 Posts 136 Posters 1.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      For internal clients, the best way is to include their hostnames on your local dns.

      Setup your pfSense box to use your internal dns.

      But, if you are using dns Forwarder on pfsense, you can also include these host info on it.

      And don't forget to save postfix config after any host change.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • M
        mauricioniñoavella
        last edited by

        marcelloc

        regards

        what a pity to disturb, look I'm working and making changes to the cfg and Services: Postfix relay and spam, but not working.

        not to do just what I want is a postfix relay host, that I may have a serviodor forwarder external mail, which is in zimbra

        using a generic account with authentication and security is, with STARTTLS

        as I have written before I had the problems that no longer do.

        thanks
        for your collaboration

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          mauricioniñoavella,

          As we saw in ermal post, package cyrrus has a missing dependencie in pfsense. Its not a missing compile arg, so there is nothing I can do to Fix it.

          For now, postfix Forwarder Does not has SASL option.

          If you want a quick solution for that, buy some commercial support hours as ask pfsense team to Fix it.

          If you google for you problem, you will find that openldap client requires cyrrus too.

          good luck on your trouble shooting.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • M
            mauricioniñoavella
            last edited by

            marcelloc
            then you confirm that the problem is not yours, rom problems pfSense team, then you spor angry about this that you wrote

            I see you work for us.

            many thanks for your collaboration

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @mauricioniñoavella:

              marcelloc
              then you confirm that the problem is not yours, rom problems pfSense team, then you spor angry about this that you wrote

              I see you work for us.

              many thanks for your collaboration

              mauricioniñoavella,

              you must understand one thing.

              pfsense's team released version 2.0 with no need of cyrrus-sasl library, so the problem is not with pfsense's team.

              Packages are contributions and almost created and maintained by community, so when a package has a problem, the problem is not on pfsense2.0.

              When somebody builds a package, all ports compilation is done by pfsense team BUT it does not means that is fully supported by them.

              Pfsense is one thing, packages is another thing completely apart of base project.

              if you don't like the way libraries are missing on pfsense, try installing freebsd packages on labs.

              I'm not angry about anything in pfsense's project, its perfect to me.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • M
                mauricioniñoavella
                last edited by

                marcelloc

                To my pfSense also is an excellent project.

                In fact I think it is good to realize this problem, as I have experienced that served to improve your package. And that the community forum to find out.
                It is very important to account for other versions as I could incorporate cyrrus-sasl library, I hope you will contribute to have been able to let you know this,
                Thank you very much for your input.
                To think this forum, to share and we want this project. As is pfSense, and do not take as a destructive criticism but a constructive criticism.
                I hope you take it in practice because it is a benefit to all who participated in this forum, showing the possible problems that arise in the project, to improve it.
                The Free BSD Project was born to be a complete Unix-like operating system free software, software that respects your freedom. and best of all and for all.

                I will be working to bring you the package for continuous improvement in your work is excellent, because I think an excellent system, and wait when you merge with relay host including cyrrus-sasl.

                thanks

                Mauricio

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  HI all,

                  I've just released package version 2.2 with:

                  • Sqlite database log support

                  • Widget for dashboard with mail stats

                  • Search email tool for diagnostics

                  • checkbox to enable or not smtp_valid_hostname_check

                  • few more help info for easier setup

                  check first post for screen shots.

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • D
                    darklogic
                    last edited by

                    Awsome news. I hope this corrects my issue. I will post something here in a bit that I have encountered.

                    1 Reply Last reply Reply Quote 0
                    • D
                      darklogic
                      last edited by

                      OK, so the rejects that I have been getting seems to occure when the remote host excepts e-mail on a different public IP than the one it sends from. I discovered this by talking with some IT people that I have been getting all these legitamite e-mail rejects on the helo host not found. They have something like an ironport or barracuda acting as a mail gateway behind a firewall in bound SMTP on a particular IP and then their mail server has a statis 1-to-1 NAT rule that translates outbound sending of mail on a different IP.

                      I have not idea how to even resolve this since it tries the verify back to an IP that does not listen or forward mail back to the internal mail server.

                      Please let me know if this is not a clear enough write up on what I am saying.

                      Thanks for all you do marcelloc

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        The helo smtp info can be easily configured by email admins, including Micro$oft. The default option is something internal like hostname.local if you do not use any server for relay to internet.

                        Unckeck this option and see how postfix deals with your spammers.

                        On my clients networks, I do only accept mail from server that are not misconfigured.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • D
                          darklogic
                          last edited by

                          on your check box for helo check. I see it says checked for default. So if I check it, I am assuming it will check helo and if it is unchecked it will not check helo?

                          Thanks,

                          1 Reply Last reply Reply Quote 0
                          • D
                            darklogic
                            last edited by

                            ahhh, I think your updated package has worked. I am starting to recieve these e-mails now. I just recieved the ones from earlier today.

                            This makes me feel so much better.

                            Thanks marcelloc

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              Great news. In few days you will have many logs on Database. Take a look on dashboard postfix widget and on search mail.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • D
                                darklogic
                                last edited by

                                I am currently looking into it. Great work marcelloc.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  darklogic
                                  last edited by

                                  This is odd. I am getting an error when trying to go to avalible packages. Are you getting this?

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    darklogic
                                    last edited by

                                    This is the error I am getting. It was just working???

                                    Unable to communicate with www.pfsense.com. Please verify DNS and interface configuration, and that pfSense has functional Internet connectivity.

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      darklogic
                                      last edited by

                                      It was SNORT HTTP inspect causing the issue.

                                      Anyways, I have a question about the logs. I am not seeing anything showing up yet. I followed the instructions, but don't understand the last line that I highlighted below in red.

                                      Choose how often pfSense will transfer log files to Sqlite database.
                                      To use Diagnostics -> Search mail you need to:
                                      Select Loggin Destination to /var/log/maillog
                                      Select update Sqlite frequency
                                      Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules.

                                      Thanks,

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        Go to acls tab and include the subject line in header option.

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          darklogic
                                          last edited by

                                          OK, got it. I am starting to see data coming into the logs.

                                          You have done an excellent job on this package. Thanks for all your hard work.

                                          Thanks,

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            cmariotti
                                            last edited by

                                            I posted a question to the pfSense mailing list and was directed to look at the Postfix relay package. I saw a posting asking if SMTP out was an option, but I didn't see a clear answer to this.

                                            Let me explain my issue…

                                            After converting a network of computers to use a fairly popular 3rd party email service (not my decision unfortunately), users are experiencing very odd issues with email (POP and SMTP based). The 3rd party says we should try different ports, increase timeouts, etc…  and they sometimes take days to admit they themselves have an issue (after we have jumped through their hoops).

                                            One of the issues is email taking a while to be sent out of the network to the 3rd party SMTP servers… in many cases, items sit in Outlook… with recipients complaining that they received multiple copies of the same email.

                                            My thought was to see if there was an SMTP server that can run on pfSense 2.0? I would like to be able to monitor the queue, etc…  My hope is that the client computers would stop failing/timing out/multiple deliveries and that pfSense would just act as the active sender SMTP server... basically to send out emails from the network directly to the recipient's mailserver... But I need to be able to manage and monitor it easily in real-time and after the fact on specific dates/times to see what is happening with a specific email problem.

                                            Any advice or suggestions? Does the replay package allow this? Or is it simply for inbound emails only?

                                            Regards,

                                            Chuck

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.