Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved pfSense Packages
    855 Posts 136 Posters 1.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      DQM
      last edited by

      Dear Marcello,

      I have just installed PF 2.10 on new my box (2.0.3). But it seems not work with Active Directory ( I didn't see the adexport.pl file at /usr/local/etc/postfix).

      Could you please show me how does it work with Active Directory to export recipients to the relay_recipients file?

      Thank you and look forward to your reply.
      DQM

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        adexport.pl stays on /usr/local/bin/ but you need first to install p5-perl-ldap package.

        You can install it with pkg_add from my repo or from freebsd repo

        amd64
        pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

        i386
        pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • D
          DQM
          last edited by

          Thanks Marcello,

          It works well now  :)

          1 Reply Last reply Reply Quote 0
          • J
            JohnConnor
            last edited by

            Hi Marcelloc,

            First thanks for your great job

            I just want to ask you something, I have an issue in the configuration of the forwarding domains.
            I have three domains to relay to my mailserver, but when I add them in the GUI, click save, it save only the last domain.
            I tried to add them manually in the transport and main.cf file, but the change does not appear in the GUI

            I have this issue in both i386/x64 release of pfsense 2.1
            Postfix forwarder  2.10.0 pkg v.2.3.6

            Do you have an idea ?

            Regards
            John

            EDIT:
            I found the problem is internet explorer.
            Everything works with chrome, sorry for my mistake

            1 Reply Last reply Reply Quote 0
            • K
              kwaci
              last edited by

              @kwaci:

              Hi All,

              Im new in this forum. Im just installing pfSense with Postfix and Mailscanner package as SMTP relay for our Exchange 2003 server.
              It work very well. Postscreen and RBL checks are the day saver.  :)

              Thank you

              Hi All and marcelloc,

              It has been four months since i`m using this antispam and relay package.
              And it still work very well.

              Thank you  pfSense and marcelloc for creating such a good system.

              tips : keep the maillog file rotated

              1 Reply Last reply Reply Quote 0
              • B
                brokendash
                last edited by

                Any plans for some ipv6 support? also everytime I reboot I have to manually replace my master.cf config and restart the service…

                I need postfix to listen on ipv6 so with no interfaces selected the within the web gui the /usr/pbi/postfix-i386/etc/postfix/master.cf ends up getting modified adding my wan ip info.

                MY.WAN.IP:25 inet  n      -      n      -      1      postscreen

                This means every reboot postfix starts up only listening to my a single address….

                Im simply desiring the web gui to allow for one to select no interfaces allowing for the master.cf to contain the single smtp option.

                smtp     inet  n      -      n      -      1      postscreen

                This would essentially allow for my other ipv6 config details to be configured within the web gui's custom main.cf options area….

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  @brokendash:

                  Im simply desiring the web gui to allow for one to select no interfaces allowing for the master.cf to contain the single smtp option.

                  I'll put it on my todo list.

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    Done! :)

                    Install/upgrade to 2.10.2 pkg v.2.3.7  postfix-forward package version.

                    Do not forget to revise config tabs after upgrade.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • B
                      biggsy
                      last edited by

                      Hi Marcello,

                      Since updating to 2.10.2 pkg v.2.3.7 no mail relayed and seeing these messages in the log:

                      Dec  8 06:57:44 postfix/smtp[2973]: connect to 192.168.11.2[192.168.11.2]:25: Operation timed out
                      Dec  8 06:57:44 postfix/smtp[2973]: 7AC81B934: to=<me@my.domain>, relay=none, delay=1065, delays=1035/0.01/30/0, dsn=4.4.1, status=deferred (connect to 192.168.11.2[192.168.11.2]:25: Operation timed out)</me@my.domain>
                      

                      Have restarted postfix many times and tried both "IPv4 only" and "all" options.  Reinstalled, no change.

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        Can you post part of main.cf(interface section) and output of netstat -an | grep -i listen?

                        Pfsense 2.1?

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • B
                          biggsy
                          last edited by

                          Thanks.

                          Yes, 2.1-RELEASE (amd64) built on Wed Sep 11 18:17:48 EDT 2013

                          Not sure what you mean by "interface section".  Here is a sanitized version of main.cf:

                          /usr/pbi/postfix-amd64/etc/postfix/main.cf
                          #main.cf\
                          #Part of the Postfix package for pfSense
                          #Copyright (C) 2010 Erik Fonnesbeck
                          #Copyright (C) 2011-2013 Marcello Coutinho
                          #All rights reserved.
                          #DO NOT EDIT THIS FILE
                          
                          mynetworks = /usr/pbi/postfix-amd64/etc/postfix/mynetwork_table
                          mynetworks_style = host
                          access_map_reject_code= 554
                          access_map_defer_code = 451
                          unverified_recipient_reject_code = 550
                          unknown_client_reject_code = 550
                          unknown_hostname_reject_code = 550
                          myhostname = <mail.my.domain>
                          bounce_queue_lifetime = 0s
                          postscreen_cache_retention_time = 30d
                          anvil_status_update_time = 1h
                          notify_classes = protocol
                          relay_domains = <first.domain> <second.domain>
                          transport_maps = hash:/usr/pbi/postfix-amd64/etc/postfix/transport
                          local_recipient_maps =
                          mydestination =
                          mynetworks_style = host
                          message_size_limit = 30000000
                          default_process_limit = 100
                          disable_vrfy_command = yes
                          strict_rfc821_envelopes = yes
                          
                          #Just reject after helo,sender,client,recipient tests
                          smtpd_delay_reject = yes
                          
                          # Don't talk to mail systems that don't know their own hostname.
                          smtpd_helo_required = yes
                          smtpd_helo_restrictions = check_helo_access pcre:/usr/pbi/postfix-amd64/etc/postfix/helo_check,
                          				reject_unknown_helo_hostname,
                          				reject_invalid_helo_hostname,
                          				reject_non_fqdn_helo_hostname,
                          				permit
                          
                          smtpd_sender_restrictions = reject_non_fqdn_sender,
                          				reject_unknown_sender_domain,
                          				reject_unauth_pipelining,
                          				reject_multi_recipient_bounce,
                          				permit
                          
                          # Allow connections from specified local clients and strong check everybody else.								
                          smtpd_client_restrictions = permit_mynetworks,
                          				reject_unauth_destination,
                          				check_client_access pcre:/usr/pbi/postfix-amd64/etc/postfix/cal_pcre,
                          				check_client_access cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr,
                          				reject_unknown_client_hostname,
                          				reject_unauth_pipelining,
                          				reject_multi_recipient_bounce,
                          				permit							
                          
                          smtpd_recipient_restrictions = permit_mynetworks,
                          				reject_unauth_destination,
                          				reject_unauth_pipelining,
                          				check_client_access pcre:/usr/pbi/postfix-amd64/etc/postfix/cal_pcre,
                          				check_client_access cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr,
                          				check_sender_access hash:/usr/pbi/postfix-amd64/etc/postfix/sender_access,
                          				reject_non_fqdn_helo_hostname,
                          				reject_unknown_recipient_domain,
                          				reject_non_fqdn_recipient,
                          				reject_multi_recipient_bounce,
                          				reject_unverified_recipient,
                          				permit
                          
                          inet_protocols = ipv4
                          inet_interfaces = <my.public.ip>
                          postscreen_disable_vrfy_command = yes
                          postscreen_non_smtp_command_enable = yes
                          postscreen_non_smtp_command_action = enforce
                          postscreen_pipelining_enable = yes
                          postscreen_pipelining_action = enforce
                          postscreen_bare_newline_enable = yes
                          postscreen_bare_newline_action = enforce
                          postscreen_greet_action = enforce
                          postscreen_access_list = permit_mynetworks,
                          			cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr
                          postscreen_dnsbl_action= enforce
                          postscreen_blacklist_action= enforce</my.public.ip></second.domain></first.domain></mail.my.domain>
                          

                          and netstat output:

                          
                          tcp4       0      0 <my.public.ip>.25       *.*                    LISTEN
                          tcp6       0      0 *.53                   *.*                    LISTEN
                          tcp4       0      0 *.53                   *.*                    LISTEN
                          tcp6       0      0 *.443                  *.*                    LISTEN
                          tcp4       0      0 *.443                  *.*                    LISTEN
                          tcp4       0      0 *.22                   *.*                    LISTEN
                          tcp6       0      0 *.22                   *.*                    LISTEN</my.public.ip>
                          
                          1 Reply Last reply Reply Quote 0
                          • B
                            biggsy
                            last edited by

                            I've been running WireShark on the mail server.  As expected, no connections to port 25.

                            May not be relevant but I just found these in syslog:

                            
                            Dec  8 06:57:15 postfix/master[12027]: warning: ignoring inet_protocols parameter value change
                            Dec  8 06:57:15 postfix/master[12027]: warning: old value: "all", new value: "ipv4"
                            Dec  8 06:57:15 postfix/master[12027]: warning: to change inet_protocols, stop and start Postfix
                            
                            
                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              That's why I have changed field info warning to restart postfix daemon after changing inet protocol or ip.

                              Netstat and config shows it listening on public address.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • B
                                biggsy
                                last edited by

                                @marcelloc:

                                That's why I have changed field info warning to restart postfix daemon after changing inet protocol or ip.

                                That's why I thought it might not be relevant.  I have restarted many times.  Even rebooted pfSense.

                                @marcelloc:

                                Netstat and config shows it listening on public address.

                                Yes, postfix is receiving emails but can't forward them to the mail server, it's just queuing them. That was working perfectly prior to the update.

                                Did you notice the "relay=none" in the log record?  Prior to the update it was "relay=192.168.11.2[192.168.11.2]:25"

                                The relay host is set in the GUI for both domains to 192.168.11.2 and I can telnet 192.168.11.2 25 from an ssh session to pfSense without any problem.

                                1 Reply Last reply Reply Quote 0
                                • B
                                  biggsy
                                  last edited by

                                  Netstat and config shows it listening on public address.

                                  Now I see what you were saying.

                                  I changed it to listen on loopback (instead of WAN) and it started delivering both queued and new emails.

                                  I remembered you saying "choose at least wan loopback interfaces" when the package was very new but I have had postfix only listen on WAN since I first installed it.  That was the only way I could get it to work before this latest update.  I honestly don't remember the error I used to get if I listened on loopback.

                                  Why would it need both WAN and loopback?

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    I've moved listening options from master.cf to main.cf on this latest update.

                                    I'll test it here and update interface field info to warn about this behavior.

                                    Thanks for your feedback.

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      biggsy
                                      last edited by

                                      Without being restarted, is the postfix package somehow aware of changes in WAN IP?

                                      It hasn't been a problem for me but I had thought about it this past couple of days.

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        @biggsy:

                                        It hasn't been a problem for me but I had thought about it this past couple of days.

                                        It will work fine if you listen on loopback and create a nat rule from wan address to 127.0.0.1

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          biggsy
                                          last edited by

                                          @marcelloc:

                                          It will work fine if you listen on loopback and create a nat rule from wan address to 127.0.0.1

                                          no
                                          Did you mean to say "nat rule"?  I've never had a NAT - just a rule: pass any source in to destination WAN net on port 25.

                                          Although, I'm not using postfix for outbound.

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            This is a common setup while using carp.

                                            You configure the package(squid,snort,dansguardian,etc) to listen only on 127.0.0.1 and then create a nat rule to forward lan,wan,etc Carp address to 127.0.0.1.
                                            This way you keep package running on both boxes without missing inet address startup errors.

                                            If you configure this way on your wan, every time it changes ip, postfix will keep working as it's listening on lo0 and pfsense will keep the forward from wan address to it.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.