Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved pfSense Packages
    855 Posts 136 Posters 1.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Sn3ak
      last edited by

      Figured I would report my success. The package looks great.
      It looks like Anvil Daemon is more or less required, otherwise
      it spits out errors in the maillog, and seems to cause a small
      connection delay as well (at least on my setup).

      I turned off most of the protections, since it is a secondary
      MX, and I wasn't doing any filtering previously, at least until
      I have a chance to read up more as to what the settings do.

      I am however however excited by the Valid recipients from clear
      text url option. That will cut out a lot of the junk that gets stuck
      in the secondary MX.

      I'll need to read more about that, and find out the format of the
      text file, and how often it polls, but that is a very nice option.

      Thanks for the good work.

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        The format is

        Email@domain.com ok
        Admin@domain.com ok
        .
        .
        .

        As my active directory is on local lan, I've setup a 1h update frequecy.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • S
          Sn3ak
          last edited by

          Thanks, I haven't had a chance to try that.. I do have another problem that you may be able to help me with.

          It seems adding:
          myhostname=mx02.example.com
          smtp_helo_name=mx02.example.com

          is ignored by postfix, at first it wasn't being added to main.cf, but finally that started working, however is being ignored.

          postconf -d | grep example
          mydomain = example.local
          myhostname = pfsense.example.local

          as well as smtp_helo_name =  not being respected if changed either.

          I'm attempting to change the name to my correct external hostname so other email servers (including my primary) don't get
          upset due to the .local address

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            Change pfsense host and domain info on system settings.

            Did you tried to paste this config on custom field and then checking config file?

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • S
              Sn3ak
              last edited by

              Sorry for the late reply, as it turns out the settings did take, however postconf -d
              doesn't reflect it, and, using telnet on localhost apparently uses the default and
              ignores the setting.

              Would it be possible to add a delete option in the queue screen, since you are already displaying the Message ID?
              Command would be postsuper -d msgID. Also maybe another button at the bottom for deleting all Mailer-Daemon
              emails? Command would be: mailq | grep -v "^[^0-9A-Z]" | grep MAILER-DAEMON | awk '{print $1}' | xargs postsuper -d

              If nothing else, I can probably submit patches, as long as you are interested in including them.

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                Good to know this package is being usefull for you. :)

                Did you applied postfix conf after changing machine name and domain?

                Patches and improvements are welcome, let me test it first before publishing.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • P
                  Popupgbg
                  last edited by

                  Split domain mail functionality

                  I don´t know if this package can do this but it would be nice to have it with a GUI. I know that sometimes hosting providers is using Postfix to provide a split domain functionality on mailservice. The use Postfix to receive all mails addressed to different recipients in different domains in Postfix. They setup the possibility to forward incoming mail so that mail to a@domain.com  is sent to an POP server and mail to b@domain.com to an Exchange server. This due to the fact that all users in an organization don´t need the functionality of an Exchange server.
                  This is my request  :)

                  /Thanks

                  1 Reply Last reply Reply Quote 0
                  • M
                    madas
                    last edited by

                    Hello,

                    I'm trying to modify this part of the main.cf to remove the reject_unknown_sender_domain

                    –--------------
                    smtpd_sender_restrictions = reject_unknown_sender_domain,
                    permit

                    My server is using a remote DNS so I cannot add a A or MX record for some of my local servers so I need to remove this option (or add a permit_mynetworks above it).

                    I cannot seem to do this anyway in the gui.  I can do it manually but it seems to be overwritten shortly after.

                    Any ideas?

                    Thanks

                    M

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      Madas,

                      Include your hosts on my network acl.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • M
                        madas
                        last edited by

                        I have.  The reject_unknown_sender_domain seems to be bouncing the message before the network ACL's are checked.

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          @madas:

                          I have.  The reject_unknown_sender_domain seems to be bouncing the message before the network ACL's are checked.

                          It will work if you create this dummy domain on your internal dns and point pfsense to use it.

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • M
                            madas
                            last edited by

                            My firewall points directly to the ISP's DNS.  I don't run a local one that is accessible from my firewall.  I just want to remove that restriction

                            1 Reply Last reply Reply Quote 0
                            • L
                              LinuxTracker
                              last edited by

                              Finally set this up today and have read through the thread.

                              I seem to be missing something in the basic configuration.

                              Notes: I disabled the port 25 NAT and associated rule.
                              A new rule to allow port 25 to WAN Address is in place and is logged.
                              I let it run for 15+min.

                              My Port 25 Rules block 1k spam connects/hour.  I find I've grown attached to them. /notes

                              Problem:
                              If I bind to Postfix to WAN, Postfix receives and passes mail correctly; but Port 25 Rules are ignored.
                              When I bind to loopback-only, I don't see any indication that any mail is reaching Postfix.

                              In both cases, the Rule Logs show traffic being passed to the WAN address.

                              What am I missing?

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                Hi linuxtracker,

                                When you listen postfix on loopback only, you need a Nat rule to forward traffic from wan address to localhost.

                                In both cases, you need to put block rules before allow rules on firewall tab.

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • L
                                  LinuxTracker
                                  last edited by

                                  @marcelloc:

                                  In both cases, you need to put block rules before allow rules on firewall tab.

                                  Crap.  That is exactly what I did.  I know better too.

                                  Now I have to go wear the hat for the rest of the day.

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    No intention to call you dunce, I was just posting full info to solve your problem.
                                    Sorry.  :(

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      LinuxTracker
                                      last edited by

                                      @marcelloc:

                                      No intention to call you dunce, I was just posting full info to solve your problem.
                                      Sorry.

                                      I wasn't irritated with you.  I was poking fun at myself for making a rookie mistake.

                                      If you hadn't set me straight, I'd probably still be banging my head against it.

                                      So - Thank you.

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        digdug3
                                        last edited by

                                        Is it possible to forward all incoming domains to another mail server after the email address had been checked?
                                        So * to ip x.x.x.x

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          You can configure smart relay options, but I think it's not a good idea as postfix will accept any email, including relay atempts and your internal server will miss the external IP address to do spam checks.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            digdug3
                                            last edited by

                                            @marcelloc:

                                            You can configure smart relay options, but I think it's not a good idea as postfix will accept any email, including relay atempts and your internal server will miss the external IP address to do spam checks.

                                            Ok, but is it possible to add the domains just like the valid recipients? e.g. a txt file from an external url?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.