Postfix - antispam and relay package

cmariotti

So basically just install the package, create spf record for the public IP and point the clients to use the internal firewall IP as their SMTP server. That sound right?

marcelloc

Yes. That's it.

On package, try this configurarion:

listen only in localhost and lan
disable postscreen
choose basic header verification
do not check Helo valid hostname
at acls, include your internal network on client access list

timreichhart

does this package have a option for users to manage there whitelist/blacklist or any other options they need to configure under there own login page?

marcelloc

This package act as a relay for internal smtp server. Postfix on pfsense has no client accounts or user page.

darklogic

marcelloc,

Any word on the postfix AV and anti-spam add-on? Your latest release fixed all the issues I was having. Great package. I am excited to see what will come next.

Thanks Again,

marcelloc

The upcoming version 2.3 improves maillog Database and fixes some minor bugs.

Mailscanner maybe released in december.

darklogic

That is excellent news. Keep up the great work.

Thanks Again,

MDP

mince69meat

@marcelloc:

Hi all,

Postfix compilation on x64 now includes cyrus-SASL2 and TLS.

who need or want to test it, reinstall or remove/install postfix package.

No changes in gui for this option. Include all your SASL and/or TLS config in custom main.cf options

att,
Marcello Coutinho

Hi Marcello and everyone else

can anyone help me out I would like to send mail from internal to exturnal though this fantastic packege but can't get passed "smtpd_recipient_restrictions = reject_unauth_destination" have tried "smtpd_recipient_restrictions = permit_mynetworks reject_unauth_destination" in custom but it will not override the defaults, tried SASL but don't know how to install it on pfsense, have spent a week doing this before postting so sorry if its in a post elswere, any help or point to any posts that could help or how to override the default would be grateful

Mick

marcelloc

mince69meat,

I'ts included in upcoming version 2.3. I'm finished coding and now I'm testing before publishing.

The not so good news is that 2.2 sqlite database is not compatible with 2.3.

mince69meat

@marcelloc:

mince69meat,

I'ts included in upcoming version 2.3. I'm finished coding and now I'm testing before publishing.

The not so good news is that 2.2 sqlite database is not compatible with 2.3.

Love you man, im up all though the night as I was just about to build a bsd VM to get around the problem till your fantastic package was more.. if you want I have a fresh PF without postfix just finnished installing if you need a tester :-) before release. dont know what to do now wait or carry on with the bsd VM, dont know if I can help any more than being a user tester but know a little about coding and postfix, great work - respect

marcelloc

to patch 2.2 to accept mynetworks,BACKUP /usr/local/pkg/postfix.inc to /root dir and then edit /usr/local/pkg/postfix.inc to modify postfix declaration.

Do not backup postfix.inc file on same dir, it will break your boot.

look for 'postscreen_access_list=' and include permit_mynetworks:
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"

look for 'smtpd_recipient_restrictions=' (02 times in file) and include permit_mynetworks
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,

save file, Go to custom options in gui, declare 'mynetworks' list save config and check main.cf file in view configuration tab


Examples:
mynetworks = 127.0.0.0/8 168.100.189.0/28
mynetworks = !192.168.0.1, 192.168.0.0/28
mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64
"mynetworks_style = host"
"mynetworks_style = subnet" 
"mynetworks_style = class"

reference: http://www.postfix.org/postconf.5.html

mince69meat

@marcelloc:

to patch 2.2 to accept mynetworks,BACKUP /usr/local/pkg/postfix.inc to /root dir and then edit /usr/local/pkg/postfix.inc to modify postfix declaration.

Do not backup postfix.inc file on same dir, it will break your boot.

look for 'postscreen_access_list=' and include permit_mynetworks:
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"

look for 'smtpd_recipient_restrictions=' (02 times in file) and include permit_mynetworks
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,

save file, Go to custom options in gui, declare 'mynetworks' list save config and check main.cf file in view configuration tab
Examples:
mynetworks = 127.0.0.0/8 168.100.189.0/28
mynetworks = !192.168.0.1, 192.168.0.0/28
mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64
"mynetworks_style = host"
"mynetworks_style = subnet" 
"mynetworks_style = class"
reference: http://www.postfix.org/postconf.5.html

Hi marcelloc, knew to edit postfix.inc (would have missed postscreen_access_list, thanks), did not want to edit this file as I'm worried about braking the package on updates, can you comfirm this will not brake anything on update? was looking for a way to override just by the "custom main.cf options" to keep the package as you made it :-) and not cause problems on upgrades as I have boken things in the past by doing things my way and not the matainers way lol

some info for you, installing postfix on x64 I see that cyrus-sasl-2.1.25_1.tbz is installed as dependencie but on a x86 system it is not installed, don't know if you know that, also for the rest of the community pkg_add will not install it properly on x86 :-(

nice work and brill post about adding mynetworks, should help more on here out than just me

respect

marcelloc

The postfix in 32 bit version is not compilled every day just like 64bits. This may be something related to 2.1 working. The cyrrus-SASL has a missing dependencie that was not fixed yet, So you can only use unauth outgoing smtp for now.

About the postfix.inc, if you do the way I described, it will not broke any package update. Just insert the update on file and do not remove anything.
Package update will update postfix.inc
Do it with caution.
I'll send a line to core team asking 32bits updates.
Postix is on 2.8.7 on 64 bits and 2.8.5 on 32.

mince69meat

How would you use unauth outgoing smtp and get passed the "reject_unauth_destination" or is the only wayto edit /usr/local/pkg/postfix.inc as you said a few posts back?

mince69meat

@marcelloc:

to patch 2.2 to accept mynetworks,BACKUP /usr/local/pkg/postfix.inc to /root dir and then edit /usr/local/pkg/postfix.inc to modify postfix declaration.

Do not backup postfix.inc file on same dir, it will break your boot.

look for 'postscreen_access_list=' and include permit_mynetworks:
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"

look for 'smtpd_recipient_restrictions=' (02 times in file) and include permit_mynetworks
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,

save file, Go to custom options in gui, declare 'mynetworks' list save config and check main.cf file in view configuration tab
Examples:
mynetworks = 127.0.0.0/8 168.100.189.0/28
mynetworks = !192.168.0.1, 192.168.0.0/28
mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64
"mynetworks_style = host"
"mynetworks_style = subnet" 
"mynetworks_style = class"
reference: http://www.postfix.org/postconf.5.html

is this line right the middle part (tcidr) just don't seem right?
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"

mince69meat

hope someone can help with this one, have multi wan and want postfix to send mail out of non default wan gateway, tried smtp_bind_address = xxx.xxx.xxx.xxx and it works sendding out but then incoming mail will not forward to internal mail server, any hint want to try either on pf firewall or postfix would be great

Mince

marcelloc

Did you created a wan rule to accept incoming traffic on this ip?

Another way to do it is listening postfix on loopback and then create inbound and outbound nat to your ip aliases or carp.

is this line right the middle part (tcidr) just don't seem right?
postscreen_access_list = permit_mynetworks,\n\t\t\tcidr:/usr/local/etc/postfix/cal_cidr\n"

Just include the 'permit_mynetworks,' at The beginning of postscreen_access_list.

marcelloc

Hi everybody,

I've just published package version 2.3 with many improvements. check first post for screen shots

main improvements:

sqlite export option to allow multiple box admins to search mail in only one box
new database structure
queue gui tab
more search options
wildcard support in search
postfix version 2.8.7 for x64bits
widget options to prevent memory limit reach in dashboard
apply permissions to non adminis users, so they can only search mail or view queue
include mynetworks to allow internal clients/hosts to send mail through postfix forwarder

mince69meat

hi all, first off, fantastic work on 2.3 :-)

now on a PF x86 box we have

Downloading http://files.pfsense.org/packages/8/All/perl-5.12.4_3.tbz … could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/perl-5.12.4_3.tbz.
of perl-5.12.4_3 failed!

x64 box all seens fine so far will play alot more and report back soon, hopping the above error is just waitting for the ports to update

Mince

marcelloc

mince69meat,

thanks for your feedback.

I've just fixed 32bits perl version. try again in 15minutes.