Postfix - antispam and relay package

marcelloc

HI all,

I've just released package version 2.2 with:

Sqlite database log support
Widget for dashboard with mail stats
Search email tool for diagnostics
checkbox to enable or not smtp_valid_hostname_check
few more help info for easier setup

darklogic

Awsome news. I hope this corrects my issue. I will post something here in a bit that I have encountered.

darklogic

OK, so the rejects that I have been getting seems to occure when the remote host excepts e-mail on a different public IP than the one it sends from. I discovered this by talking with some IT people that I have been getting all these legitamite e-mail rejects on the helo host not found. They have something like an ironport or barracuda acting as a mail gateway behind a firewall in bound SMTP on a particular IP and then their mail server has a statis 1-to-1 NAT rule that translates outbound sending of mail on a different IP.

I have not idea how to even resolve this since it tries the verify back to an IP that does not listen or forward mail back to the internal mail server.

Please let me know if this is not a clear enough write up on what I am saying.

Thanks for all you do marcelloc

marcelloc

The helo smtp info can be easily configured by email admins, including Micro$oft. The default option is something internal like hostname.local if you do not use any server for relay to internet.

Unckeck this option and see how postfix deals with your spammers.

On my clients networks, I do only accept mail from server that are not misconfigured.

darklogic

on your check box for helo check. I see it says checked for default. So if I check it, I am assuming it will check helo and if it is unchecked it will not check helo?

Thanks,

darklogic

ahhh, I think your updated package has worked. I am starting to recieve these e-mails now. I just recieved the ones from earlier today.

This makes me feel so much better.

Thanks marcelloc

marcelloc

Great news. In few days you will have many logs on Database. Take a look on dashboard postfix widget and on search mail.

darklogic

I am currently looking into it. Great work marcelloc.

darklogic

This is odd. I am getting an error when trying to go to avalible packages. Are you getting this?

darklogic

This is the error I am getting. It was just working???

Unable to communicate with www.pfsense.com. Please verify DNS and interface configuration, and that pfSense has functional Internet connectivity.

darklogic

It was SNORT HTTP inspect causing the issue.

Anyways, I have a question about the logs. I am not seeing anything showing up yet. I followed the instructions, but don't understand the last line that I highlighted below in red.

Choose how often pfSense will transfer log files to Sqlite database.
To use Diagnostics -> Search mail you need to:
Select Loggin Destination to /var/log/maillog
Select update Sqlite frequency
Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules.

Thanks,

marcelloc

Go to acls tab and include the subject line in header option.

darklogic

OK, got it. I am starting to see data coming into the logs.

You have done an excellent job on this package. Thanks for all your hard work.

Thanks,

cmariotti

I posted a question to the pfSense mailing list and was directed to look at the Postfix relay package. I saw a posting asking if SMTP out was an option, but I didn't see a clear answer to this.

Let me explain my issue…

After converting a network of computers to use a fairly popular 3rd party email service (not my decision unfortunately), users are experiencing very odd issues with email (POP and SMTP based). The 3rd party says we should try different ports, increase timeouts, etc… and they sometimes take days to admit they themselves have an issue (after we have jumped through their hoops).

One of the issues is email taking a while to be sent out of the network to the 3rd party SMTP servers… in many cases, items sit in Outlook… with recipients complaining that they received multiple copies of the same email.

My thought was to see if there was an SMTP server that can run on pfSense 2.0? I would like to be able to monitor the queue, etc… My hope is that the client computers would stop failing/timing out/multiple deliveries and that pfSense would just act as the active sender SMTP server... basically to send out emails from the network directly to the recipient's mailserver... But I need to be able to manage and monitor it easily in real-time and after the fact on specific dates/times to see what is happening with a specific email problem.

Any advice or suggestions? Does the replay package allow this? Or is it simply for inbound emails only?

Regards,

Chuck

marcelloc

If you have static ip on your internet connection and if you could include this ip as a Spf record on your internet dns domain, then you could configure your smtp client option to this package.

I suggest you to change pop3 to imap. It's much better.

Smtp auth with SASL is not working on current version because a missing dependencie in cyrrus-SASL package.

cmariotti

So basically just install the package, create spf record for the public IP and point the clients to use the internal firewall IP as their SMTP server. That sound right?

marcelloc

Yes. That's it.

On package, try this configurarion:

listen only in localhost and lan
disable postscreen
choose basic header verification
do not check Helo valid hostname
at acls, include your internal network on client access list

timreichhart

does this package have a option for users to manage there whitelist/blacklist or any other options they need to configure under there own login page?

marcelloc

This package act as a relay for internal smtp server. Postfix on pfsense has no client accounts or user page.

darklogic

marcelloc,

Any word on the postfix AV and anti-spam add-on? Your latest release fixed all the issues I was having. Great package. I am excited to see what will come next.

Thanks Again,