Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    pfSense Packages
    136
    855
    874.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      biggsy
      last edited by

      Hi Marcello,

      Since updating to 2.10.2 pkg v.2.3.7 no mail relayed and seeing these messages in the log:

      Dec  8 06:57:44 postfix/smtp[2973]: connect to 192.168.11.2[192.168.11.2]:25: Operation timed out
Dec  8 06:57:44 postfix/smtp[2973]: 7AC81B934: to=<me@my.domain>, relay=none, delay=1065, delays=1035/0.01/30/0, dsn=4.4.1, status=deferred (connect to 192.168.11.2[192.168.11.2]:25: Operation timed out)</me@my.domain>

      Have restarted postfix many times and tried both "IPv4 only" and "all" options.  Reinstalled, no change.

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        Can you post part of main.cf(interface section) and output of netstat -an | grep -i listen?

        Pfsense 2.1?

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • B
          biggsy
          last edited by

          Thanks.

          Yes, 2.1-RELEASE (amd64) built on Wed Sep 11 18:17:48 EDT 2013

          Not sure what you mean by "interface section".  Here is a sanitized version of main.cf:

          /usr/pbi/postfix-amd64/etc/postfix/main.cf
#main.cf\
#Part of the Postfix package for pfSense
#Copyright (C) 2010 Erik Fonnesbeck
#Copyright (C) 2011-2013 Marcello Coutinho
#All rights reserved.
#DO NOT EDIT THIS FILE

mynetworks = /usr/pbi/postfix-amd64/etc/postfix/mynetwork_table
mynetworks_style = host
access_map_reject_code= 554
access_map_defer_code = 451
unverified_recipient_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
myhostname = <mail.my.domain>
bounce_queue_lifetime = 0s
postscreen_cache_retention_time = 30d
anvil_status_update_time = 1h
notify_classes = protocol
relay_domains = <first.domain> <second.domain>
transport_maps = hash:/usr/pbi/postfix-amd64/etc/postfix/transport
local_recipient_maps =
mydestination =
mynetworks_style = host
message_size_limit = 30000000
default_process_limit = 100
disable_vrfy_command = yes
strict_rfc821_envelopes = yes

#Just reject after helo,sender,client,recipient tests
smtpd_delay_reject = yes

# Don't talk to mail systems that don't know their own hostname.
smtpd_helo_required = yes
smtpd_helo_restrictions = check_helo_access pcre:/usr/pbi/postfix-amd64/etc/postfix/helo_check,
				reject_unknown_helo_hostname,
				reject_invalid_helo_hostname,
				reject_non_fqdn_helo_hostname,
				permit

smtpd_sender_restrictions = reject_non_fqdn_sender,
				reject_unknown_sender_domain,
				reject_unauth_pipelining,
				reject_multi_recipient_bounce,
				permit

# Allow connections from specified local clients and strong check everybody else.								
smtpd_client_restrictions = permit_mynetworks,
				reject_unauth_destination,
				check_client_access pcre:/usr/pbi/postfix-amd64/etc/postfix/cal_pcre,
				check_client_access cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr,
				reject_unknown_client_hostname,
				reject_unauth_pipelining,
				reject_multi_recipient_bounce,
				permit							

smtpd_recipient_restrictions = permit_mynetworks,
				reject_unauth_destination,
				reject_unauth_pipelining,
				check_client_access pcre:/usr/pbi/postfix-amd64/etc/postfix/cal_pcre,
				check_client_access cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr,
				check_sender_access hash:/usr/pbi/postfix-amd64/etc/postfix/sender_access,
				reject_non_fqdn_helo_hostname,
				reject_unknown_recipient_domain,
				reject_non_fqdn_recipient,
				reject_multi_recipient_bounce,
				reject_unverified_recipient,
				permit

inet_protocols = ipv4
inet_interfaces = <my.public.ip>
postscreen_disable_vrfy_command = yes
postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_action = enforce
postscreen_pipelining_enable = yes
postscreen_pipelining_action = enforce
postscreen_bare_newline_enable = yes
postscreen_bare_newline_action = enforce
postscreen_greet_action = enforce
postscreen_access_list = permit_mynetworks,
			cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr
postscreen_dnsbl_action= enforce
postscreen_blacklist_action= enforce</my.public.ip></second.domain></first.domain></mail.my.domain>

          and netstat output:

          
tcp4       0      0 <my.public.ip>.25       *.*                    LISTEN
tcp6       0      0 *.53                   *.*                    LISTEN
tcp4       0      0 *.53                   *.*                    LISTEN
tcp6       0      0 *.443                  *.*                    LISTEN
tcp4       0      0 *.443                  *.*                    LISTEN
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN</my.public.ip>
          1 Reply Last reply Reply Quote 0
          • B
            biggsy
            last edited by

            I've been running WireShark on the mail server.  As expected, no connections to port 25.

            May not be relevant but I just found these in syslog:

            
Dec  8 06:57:15 postfix/master[12027]: warning: ignoring inet_protocols parameter value change
Dec  8 06:57:15 postfix/master[12027]: warning: old value: "all", new value: "ipv4"
Dec  8 06:57:15 postfix/master[12027]: warning: to change inet_protocols, stop and start Postfix
            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              That's why I have changed field info warning to restart postfix daemon after changing inet protocol or ip.

              Netstat and config shows it listening on public address.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • B
                biggsy
                last edited by

                @marcelloc:

                That's why I have changed field info warning to restart postfix daemon after changing inet protocol or ip.

                That's why I thought it might not be relevant.  I have restarted many times.  Even rebooted pfSense.

                @marcelloc:

                Netstat and config shows it listening on public address.

                Yes, postfix is receiving emails but can't forward them to the mail server, it's just queuing them. That was working perfectly prior to the update.

                Did you notice the "relay=none" in the log record?  Prior to the update it was "relay=192.168.11.2[192.168.11.2]:25"

                The relay host is set in the GUI for both domains to 192.168.11.2 and I can telnet 192.168.11.2 25 from an ssh session to pfSense without any problem.

                1 Reply Last reply Reply Quote 0
                • B
                  biggsy
                  last edited by

                  Netstat and config shows it listening on public address.

                  Now I see what you were saying.

                  I changed it to listen on loopback (instead of WAN) and it started delivering both queued and new emails.

                  I remembered you saying "choose at least wan loopback interfaces" when the package was very new but I have had postfix only listen on WAN since I first installed it.  That was the only way I could get it to work before this latest update.  I honestly don't remember the error I used to get if I listened on loopback.

                  Why would it need both WAN and loopback?

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    I've moved listening options from master.cf to main.cf on this latest update.

                    I'll test it here and update interface field info to warn about this behavior.

                    Thanks for your feedback.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • B
                      biggsy
                      last edited by

                      Without being restarted, is the postfix package somehow aware of changes in WAN IP?

                      It hasn't been a problem for me but I had thought about it this past couple of days.

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        @biggsy:

                        It hasn't been a problem for me but I had thought about it this past couple of days.

                        It will work fine if you listen on loopback and create a nat rule from wan address to 127.0.0.1

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • B
                          biggsy
                          last edited by

                          @marcelloc:

                          It will work fine if you listen on loopback and create a nat rule from wan address to 127.0.0.1

                          no
                          Did you mean to say "nat rule"?  I've never had a NAT - just a rule: pass any source in to destination WAN net on port 25.

                          Although, I'm not using postfix for outbound.

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            This is a common setup while using carp.

                            You configure the package(squid,snort,dansguardian,etc) to listen only on 127.0.0.1 and then create a nat rule to forward lan,wan,etc Carp address to 127.0.0.1.
                            This way you keep package running on both boxes without missing inet address startup errors.

                            If you configure this way on your wan, every time it changes ip, postfix will keep working as it's listening on lo0 and pfsense will keep the forward from wan address to it.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • B
                              biggsy
                              last edited by

                              Thank you, Marcello.  Your explanation was very instructive and helpful.

                              I guess I've never had a problem because I think the only time my cable IP has changed was when I rebooted pfSense - and that's very infrequent.

                              1 Reply Last reply Reply Quote 0
                              • E
                                elementalwindx
                                last edited by

                                Wish OP would update the original post with newest info so I dont have to go thru 28 pages of whatever to see what the newest changes/versions/etc are of this package…

                                1 Reply Last reply Reply Quote 0
                                • N
                                  nekron
                                  last edited by

                                  Hi …

                                  I've some problem with Postfix Forwarder, it was installed on a new 2.1-RELEASE Install, the previous Version on a 2.1-BETA was functional (due HDD Crash i don't know the version

                                  220 pfsense.xx ESMTP Postfix
HELO xxx
250 pfsense.xxx
MAIL FROM: <michael@xxx>
250 2.1.0 Ok
RCPT TO: <michael@xxx>
450 4.1.1 <michael@xxxx>: Recipient address rejected: unverified address: connect to 172.16.1.254[172.16.1.254]:25: No route to host</michael@xxxx></michael@xxx></michael@xxx>

                                  172.16.1.254 port 25 is reachable from the pfsense-Box !

                                  Best regards,
                                  michael

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    expert_az
                                    last edited by

                                    Hello marcelloc,

                                    I'm getting these errors when attempting to query from search mail tab.

                                    instead of query results getting lines below.This happening only query with todays date(15/01/2014),when selecting another date it's working ok.

                                    Warning: sqlite_open(): file is encrypted or is not a database in
                                    /usr/local/www/postfix.php on line 544 Warning: sqlite_query() expects parameter 1 to be resource, string given in
                                    /usr/local/www/postfix.php on line 606 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                                    /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                                    /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                                    /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                                    /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in

                                    in addidion to this problem i'm getting error below when starting,restrating postfix.

                                    php: /status_services.php: The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mauricioniñoavella
                                      last edited by

                                      Hello friends, this is me showing this error.  in Package Version 2.10.2 pkg v.2.3.7

                                      I confirm if Postfix - antispam and relay package, can confirgurar with tls

                                      this is the error

                                      February 3 12:23:57 postfix / smtp [40769]: instead, send to (port submission/587) WITH STARTTLS
                                      February 3 12:23:57 postfix / smtp [40769]: CLIENT wrappermode (port smtps/465) is unimplemented

                                      So I have add to main.cf:

                                      smtp_sasl_auth_enable = yes
                                      relayhost = [smtp.xxx.xx]: 465
                                      smtp_sasl_password_maps = hash :/ etc / postfix / sasl_passwd
                                      smtp_sasl_tls_security_options = noanonymous
                                      smtp_tls_security_level = encrypt
                                      smtp_tls_mandatory_protocols =

                                      Thanks for you colaboration.

                                      Mauricio Niño Avella.

                                      1 Reply Last reply Reply Quote 0
                                      • I
                                        ics
                                        last edited by

                                        Hi,

                                        I have multifuntion printers used for scan to email.
                                        Is it possible to configure postfix/postscreen to not reply "service currently unavailable" at the first connection of these MFP without allowing them to relay to internet ?
                                        I mean I don't want to add the IPs in the MyNetworks list because it also allows these IPs to relay to internet.

                                        Thanks

                                        1 Reply Last reply Reply Quote 0
                                        • Y
                                          yaboc
                                          last edited by

                                          hi Marcello

                                          using this great tool and having some issues with the some good mails discarded by header checks because of mis-configured sender's server.

                                          Feb 12 15:57:11 postfix/smtpd[10780]: connect from ms1.cernerasp.com[159.140.193.46]
                                          Feb 12 15:57:11 postfix/smtpd[10780]: NOQUEUE: reject: RCPT from ms1.cernerasp.com[159.140.193.46]: 550 5.7.1 <taspmomail01.cmsext.com>: Helo command rejected: Host not found; from= infoviewreport@hvhc.orgto= me@mydomain.comproto=ESMTP helo= <taspmomail01.cmsext.com>Feb 12 15:57:16 postfix/smtpd[10780]: disconnect from ms1.cernerasp.com[159.140.193.46]

                                          is there an easy workaround without disabling the spam checks? thanks

                                          yaboc</taspmomail01.cmsext.com>/me@mydomain.com/infoviewreport@hvhc.org</taspmomail01.cmsext.com>

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            biggsy
                                            last edited by

                                            Best thing to do is have the admin for that mail server fix the DNS entry but you could try adding this to your Access Lists, Header section:

                                            /^From:.*@hvhc.org/ OK
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post