Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved pfSense Packages
    855 Posts 136 Posters 1.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      biggsy
      last edited by

      Netstat and config shows it listening on public address.

      Now I see what you were saying.

      I changed it to listen on loopback (instead of WAN) and it started delivering both queued and new emails.

      I remembered you saying "choose at least wan loopback interfaces" when the package was very new but I have had postfix only listen on WAN since I first installed it.  That was the only way I could get it to work before this latest update.  I honestly don't remember the error I used to get if I listened on loopback.

      Why would it need both WAN and loopback?

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        I've moved listening options from master.cf to main.cf on this latest update.

        I'll test it here and update interface field info to warn about this behavior.

        Thanks for your feedback.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • B
          biggsy
          last edited by

          Without being restarted, is the postfix package somehow aware of changes in WAN IP?

          It hasn't been a problem for me but I had thought about it this past couple of days.

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @biggsy:

            It hasn't been a problem for me but I had thought about it this past couple of days.

            It will work fine if you listen on loopback and create a nat rule from wan address to 127.0.0.1

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • B
              biggsy
              last edited by

              @marcelloc:

              It will work fine if you listen on loopback and create a nat rule from wan address to 127.0.0.1

              no
              Did you mean to say "nat rule"?  I've never had a NAT - just a rule: pass any source in to destination WAN net on port 25.

              Although, I'm not using postfix for outbound.

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                This is a common setup while using carp.

                You configure the package(squid,snort,dansguardian,etc) to listen only on 127.0.0.1 and then create a nat rule to forward lan,wan,etc Carp address to 127.0.0.1.
                This way you keep package running on both boxes without missing inet address startup errors.

                If you configure this way on your wan, every time it changes ip, postfix will keep working as it's listening on lo0 and pfsense will keep the forward from wan address to it.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • B
                  biggsy
                  last edited by

                  Thank you, Marcello.  Your explanation was very instructive and helpful.

                  I guess I've never had a problem because I think the only time my cable IP has changed was when I rebooted pfSense - and that's very infrequent.

                  1 Reply Last reply Reply Quote 0
                  • E
                    elementalwindx
                    last edited by

                    Wish OP would update the original post with newest info so I dont have to go thru 28 pages of whatever to see what the newest changes/versions/etc are of this package…

                    1 Reply Last reply Reply Quote 0
                    • N
                      nekron
                      last edited by

                      Hi …

                      I've some problem with Postfix Forwarder, it was installed on a new 2.1-RELEASE Install, the previous Version on a 2.1-BETA was functional (due HDD Crash i don't know the version

                      220 pfsense.xx ESMTP Postfix
HELO xxx
250 pfsense.xxx
MAIL FROM: <michael@xxx>
250 2.1.0 Ok
RCPT TO: <michael@xxx>
450 4.1.1 <michael@xxxx>: Recipient address rejected: unverified address: connect to 172.16.1.254[172.16.1.254]:25: No route to host</michael@xxxx></michael@xxx></michael@xxx>

                      172.16.1.254 port 25 is reachable from the pfsense-Box !

                      Best regards,
                      michael

                      1 Reply Last reply Reply Quote 0
                      • E
                        expert_az
                        last edited by

                        Hello marcelloc,

                        I'm getting these errors when attempting to query from search mail tab.

                        instead of query results getting lines below.This happening only query with todays date(15/01/2014),when selecting another date it's working ok.

                        Warning: sqlite_open(): file is encrypted or is not a database in
                        /usr/local/www/postfix.php on line 544 Warning: sqlite_query() expects parameter 1 to be resource, string given in
                        /usr/local/www/postfix.php on line 606 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                        /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                        /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                        /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
                        /usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in

                        in addidion to this problem i'm getting error below when starting,restrating postfix.

                        php: /status_services.php: The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'

                        1 Reply Last reply Reply Quote 0
                        • M
                          mauricioniñoavella
                          last edited by

                          Hello friends, this is me showing this error.  in Package Version 2.10.2 pkg v.2.3.7

                          I confirm if Postfix - antispam and relay package, can confirgurar with tls

                          this is the error

                          February 3 12:23:57 postfix / smtp [40769]: instead, send to (port submission/587) WITH STARTTLS
                          February 3 12:23:57 postfix / smtp [40769]: CLIENT wrappermode (port smtps/465) is unimplemented

                          So I have add to main.cf:

                          smtp_sasl_auth_enable = yes
                          relayhost = [smtp.xxx.xx]: 465
                          smtp_sasl_password_maps = hash :/ etc / postfix / sasl_passwd
                          smtp_sasl_tls_security_options = noanonymous
                          smtp_tls_security_level = encrypt
                          smtp_tls_mandatory_protocols =

                          Thanks for you colaboration.

                          Mauricio Niño Avella.

                          1 Reply Last reply Reply Quote 0
                          • I
                            ics
                            last edited by

                            Hi,

                            I have multifuntion printers used for scan to email.
                            Is it possible to configure postfix/postscreen to not reply "service currently unavailable" at the first connection of these MFP without allowing them to relay to internet ?
                            I mean I don't want to add the IPs in the MyNetworks list because it also allows these IPs to relay to internet.

                            Thanks

                            1 Reply Last reply Reply Quote 0
                            • Y
                              yaboc
                              last edited by

                              hi Marcello

                              using this great tool and having some issues with the some good mails discarded by header checks because of mis-configured sender's server.

                              Feb 12 15:57:11 postfix/smtpd[10780]: connect from ms1.cernerasp.com[159.140.193.46]
                              Feb 12 15:57:11 postfix/smtpd[10780]: NOQUEUE: reject: RCPT from ms1.cernerasp.com[159.140.193.46]: 550 5.7.1 <taspmomail01.cmsext.com>: Helo command rejected: Host not found; from= infoviewreport@hvhc.orgto= me@mydomain.comproto=ESMTP helo= <taspmomail01.cmsext.com>Feb 12 15:57:16 postfix/smtpd[10780]: disconnect from ms1.cernerasp.com[159.140.193.46]

                              is there an easy workaround without disabling the spam checks? thanks

                              yaboc</taspmomail01.cmsext.com>/me@mydomain.com/infoviewreport@hvhc.org</taspmomail01.cmsext.com>

                              1 Reply Last reply Reply Quote 0
                              • B
                                biggsy
                                last edited by

                                Best thing to do is have the admin for that mail server fix the DNS entry but you could try adding this to your Access Lists, Header section:

                                /^From:.*@hvhc.org/ OK
                                1 Reply Last reply Reply Quote 0
                                • I
                                  informatica_cmav
                                  last edited by

                                  Hello everybody,

                                  We have postfix forwarder working for 1 year, yesterday I update pfsense from 2.0.1 to 2.1 and reinstall postfix. Today we do not receive external mails, in the maillog we have "Recipient address rejected: unverified address" in all msgs.

                                  I search the forums and change the listen interfaces to loopback and create a nat to forward the traffic on port 25 from WAN to loopback. But the problem persists.

                                  I found a topic (https://forum.pfsense.org/index.php/topic,70541.0.html) that says that I need to configure something on Recipient tab, I really don´t have anything on this tab before.

                                  My questions are :

                                  • With the update to postfix forwarder 2.10.2 pkg v.2.3.7 it is mandatory to put the list of mail in Recipients?
                                  • We work with Zimbra the  LDAP fetch can be used with non AD enviroment?

                                  Thanks a lot

                                  1 Reply Last reply Reply Quote 0
                                  • Y
                                    yaboc
                                    last edited by

                                    @biggsy:

                                    Best thing to do is have the admin for that mail server fix the DNS entry but you could try adding this to your Access Lists, Header section:

                                    /^From:.*@hvhc.org/ OK

                                    i did add it and it's still dropping the mail sporadically. they company is using 3rd party server with their email as sender and i keep having problems with it. emails from their onsite server are coming in fine. so that be a misconfiguraed server. is disabling helo checks bad idea? it's becoming an issue now but i dont want to open doors to hell. i have a couple other mails that are good but i think their mail servers might be misconfigured. should i scan their domain with mx tool for mx server names and add those to "helo" part of access list ?

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      Bittone66
                                      last edited by

                                      Hello Guys,
                                      I have been using Postfix Forwarder for more than a year with great success.
                                      Now I moved the Pfsense VM to another server, upgraded to 2.1 and I have this problem:

                                      
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: connect from www.archidata.it[87.241.18.18]
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: NOQUEUE: reject: RCPT from www.archidata.it[87.241.18.18]: 450 4.1.1 <xxxx@alfa.it>: Recipient address rejected: unverified address: connect to 172.16.16.20[172.16.16.20]:25: Operation timed out; from= <xxxxxx@archidata.it>to= <xxxxxx@alfa.it>proto=ESMTP helo= <www.archidata.it>Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: disconnect from www.archidata.it[87.241.18.18]</www.archidata.it></xxxxxx@alfa.it></xxxxxx@archidata.it></xxxx@alfa.it>

                                      Looks similar to a previous problem in this forum flow, so I tried forwarding to localhost and setting Postifx to listen on localhost but the error remains.

                                      Now I'm forwarding directly to the DMZ in order to have email delivered (yes, the real mail server listens and works on 172.16.16.20:25).
                                      I did not setup the LDAP verification of recipient since I'll leave it to the mail server (no problem with load).
                                      One more thing: I disabled anvil and always get the anvil communication error.
                                      I already removed and re-installed the forwarder 3 times with no success.
                                      Thanks for your kind attention and support

                                      Alberto

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        Bittone66
                                        last edited by

                                        Hello,
                                        I took a alook at the enrated main.cf and, as far as I know, the entire section on smtpd_recipient_restrictions should not be there since my reicipient tab is empty and this is just a relay server.

                                        Is there a way to tell the package not to write the whole section?
                                        Thanks

                                        Alberto

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          @Bittone66:

                                          this is just a relay server.

                                          Inbound or outbound?

                                          @Bittone66:

                                          Is there a way to tell the package not to write the whole section?

                                          you can edit snort.inc and comment this part.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tfjelde
                                            last edited by

                                            Hi all

                                            I'm trying to get the mail search to work with no luck.

                                            All setting are correct as fare as i know

                                            Loggin Destination to /var/log/maillog
                                            Update Sqlite frequency every minute
                                            and i have inlcude /^Subject:/ WARN line in Acl Headers

                                            doing a  tail -f /var/log/maillog shows lines like this
                                            postfix/cleanup[22445]: 9249F114D0: warning: header Subject: test from mail.####.no

                                            But no other db files than postscreen_cache.db and verify_cache.db
                                            is showing up in /var/db/postfix

                                            2.1-RELEASE (i386)
                                            built on Wed Sep 11 18:16:22 EDT 2013
                                            FreeBSD 8.3-RELEASE-p11
                                            Postfix 2.10.2 pkg v.2.3.7

                                            Any suggestions on what to try next ?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.