Email server behind pfSense

marcelloc

94.55.x.x will be an virtual ip on your pfsense?

if so,
just change 94.55.x.x on postfix gui to 10.10.1.5

Internet –--> 94.55.x.x pfsense--->10.10.1.5 internal mail server

You will have sqlite databases when you have mail traffic on logs

nahid

Marcelo,

I have changed following way:

domainpftab.png_thumb

wanrules.png_thumb

NATrules.png_thumb

marcelloc

On port forward, create a nat rule from virtual ip 94.55.x.x to 127.0.0.1

The port forward will create the rule you need on wan interface

O postfix config, choose loopback and lan interface.

nahid

Dear Marcello,

Do I have to disable those port forward on 25 from ExternalMailServer to InternalMailServer or they will be there as like as they are?

nahid

recent status of the config:

loopback.png_thumb

portForward.png_thumb

rulesTab.png_thumb

marcelloc

@nahid:

Do I have to disable those port forward on 25 from ExternalMailServer to InternalMailServer or they will be there as like as they are?

yes, all external traffic must go to postfix (rdr from virtual ip to 127.0.0.1 with associated rule applied)

nahid

Hurrah!!!

Marcelo,

I can send emails but can't receive. Is there anything wrong?

nahid

these are log fıles:

2.0.1-RELEASE][root@pfsense.localdomain]/root(1): tail -f /var/log/maillog
May 18 22:04:28 pfsense postfix/postscreen[2216]: DISCONNECT [158.36.63.136]:234 25
May 18 22:04:28 pfsense postfix/postscreen[2216]: CONNECT from [158.36.63.136]:2 4689
May 18 22:04:28 pfsense postfix/postscreen[2216]: PASS OLD [158.36.63.136]:24689
May 18 22:04:29 pfsense postfix/smtpd[21666]: warning: 158.36.63.136: hostname e x1-stud.diastud.corp verification failed: hostname nor servname provided, or not known
May 18 22:04:29 pfsense postfix/smtpd[21666]: connect from unknown[158.36.63.136 ]
May 18 22:04:30 pfsense postfix/postscreen[2216]: NOQUEUE: reject: RCPT from [20 9.85.160.42]:36545: 450 4.3.2 Service currently unavailable; from=<tllkrmn+caf_= ="" akaraman="sesric.org@gmail.com">, to=akaraman@sesric.org, proto=ESMTP, helo= <mai ="" l-pb0-f42.google.com="">May 18 22:04:30 pfsense postfix/postscreen[2216]: PASS NEW [209.85.160.42]:36545
May 18 22:04:30 pfsense postfix/postscreen[2216]: DISCONNECT [209.85.160.42]:365 45
May 18 22:04:36 pfsense postfix/smtpd[21666]: NOQUEUE: reject: RCPT from unknown [158.36.63.136]: 554 5.7.1 centre@sesrtcic.org: Relay access denied; from= <cla ="" im@euromillionersdraw.com="">to= centre@sesrtcic.orgproto=ESMTP helo= <post.diast ="" ud.corp="">May 18 22:04:46 pfsense postfix/smtpd[21666]: disconnect from unknown[158.36.63. 136]
May 18 22:08:07 pfsense postfix/anvil[21898]: statistics: max connection rate 1/60s for (smtpd:158.36.63.136) at May 18 22:04:29
May 18 22:08:07 pfsense postfix/anvil[21898]: statistics: max connection count 1 for (smtpd:158.36.63.136) at May 18 22:04:29
May 18 22:08:07 pfsense postfix/anvil[21898]: statistics: max cache size 1 at May 18 22:04:29
May 18 22:09:42 pfsense postfix/postscreen[10615]: CONNECT from [91.102.231.30]:19466
May 18 22:09:49 pfsense postfix/postscreen[10615]: NOQUEUE: reject: RCPT from [91.102.231.30]:19466: 450 4.3.2 Service currently unavailable; from=y.owadnqb@yahoo.com, to=webmaster@sesrtcic.org, proto=SMTP, helo= <freedom>May 18 22:09:49 pfsense postfix/postscreen[10615]: HANGUP after 0.48 from [91.102.231.30]:19466 in tests after SMTP handshake
May 18 22:09:49 pfsense postfix/postscreen[10615]: PASS NEW [91.102.231.30]:19466
May 18 22:09:49 pfsense postfix/postscreen[10615]: DISCONNECT [91.102.231.30]:19466</freedom>/webmaster@sesrtcic.org /y.owadnqb@yahoo.com</post.diast >/centre@sesrtcic.org</cla >/centre@sesrtcic.org</mai >/akaraman@sesric.org</tllkrmn+caf_= >

nahid

this is the log that email didn't receive.

May 18 22:12:02 pfsense postfix/postscreen[10615]: NOQUEUE: reject: RCPT from [209.85.213.42]:33824: 450 4.3.2 Service currently unavailable; from=nahid05@gmail.com, to=anhuda@sesric.org, proto=ESMTP, helo= <mail-yw0-f42.google.com></mail-yw0-f42.google.com>/anhuda@sesric.org /nahid05@gmail.com

marcelloc

If you have enabled the postscreen, the first communication for each ip will be rejected. Just like the spamd feature

nahid

Marcelo,

so what you recommend? If I disable the postscreen I will receive emails. Or there is any other solution.

nahid

That means 2nd time sender will work properly. Am I right?

marcelloc

@nahid:

so what you recommend? If I disable the postscreen I will receive emails. Or there is any other solution.
That means 2nd time sender will work properly. Am I right?

Yes, try some sends to your domain.
I use postscreen on my setups.

att,
Marcello Coutinho

nahid

Marcelo,

You are just awesome. I am really very much grateful to you. I have just started enjoying the pfSense. It is also just awesome like you.

Thanks man for kind help.

Nahid

nahid

Marcello,

There is problem with SMTP authentication when I want to send email to my network. Is there any pass rule where I can authenticate for my sesric.org emails.

marcelloc

@nahid:

There is problem with SMTP authentication when I want to send email to my network. Is there any pass rule where I can authenticate for my sesric.org emails.

Id did not included authentication features to this package yet but you can paste these configs on custom field at postfix gui.

As this is not anymore a nat question, use this topic for postfix questions, there are some auth config samples post by forum users there.

http://forum.pfsense.org/index.php/topic,40622.0.html