Postfix - antispam and relay package
-
I believe that Postfix will eventually appear in 2.3 as a post release addition. If you scroll back a page, Marcelloc has shown that development is still in progress linking to github. For me, this is the only reason I'm holding back from rolling out 2.3 so the sooner the better 8)
Postfix will be the reason most people stay away from 2.3, pfSense is no longer a UTM…
-
It also is, but it has taken a long, long time, Macello, he said that he was preparing postfix to 2.3 for the problems that occurred in 2.2, and could not devote himself to both versions at once, that was done much, he has now gone 2.3, and still postfix still waiting.
He was ancioso by this version 2.3, in itself, I taste from RC, leaving here without postfix, something almost impresindible for me and one of the marvelous things that pfSense employment.
-
if you guys are anxious on getting postfix you should install the package, its a bsd system at the end.
-
if you guys are anxious on getting postfix you should install the package, its a bsd system at the end.
Not arguing with that but the GUI does make it easier to get up and running.
Sadly, it seems that the Postfix Forwarder is not one of the mostly widely used packages and doesn't seem to be a priority for the core team.
As dannyboy1121 pointed out, marcelloc has ported the package but he has also suggested some other changes to make life easier for packages to log. The package and the other change haven't been accepted yet. Hoping that will happen before 2.3.1 but I'm not optimistic about that.
-
Thank you for working on this, Marcello. Is there any news?
yes, I'll need to change the syslog function that enables /var/log/maillog.
Dear, Marcello.
I have a problem.
She described https://forum.pfsense.org/index.php?topic=110620.0You are given a solution to the problem. I executed the command
fetch -o /usr/local/www/postfix.php http://e-sac.siteseguro.ws/px22/postfix.txt
fetch -o /usr/local/www/widgets/widgets/postfix.widget.php http://e-sac.siteseguro.ws/px22/postfix.widget.txt
I have not changed. :'(
-
postfix is postfix, if you really need it functional, scp /your/config/files/* root@newserver:/your/new/config/files/
works…
you can check logs with cat /var/log/maillog | grep whatyouwanttosearchherethere is no point on complaining and saying that pfsense is a bad product or is no longer a UTM or all that 'sadness' (for not saying another word) trying to make the developers feel bad for you guys. they will fix it at some point. if you cant live without the graphical interface, set a VM, some forwarding rules and run it from there.
if you are unhappy, get a grip and start coding a patch yourself apply it, test it and share it here. any volunteer? ;)
-
if you guys are anxious on getting postfix you should install the package, its a bsd system at the end.
While indeed it's a bsd system at the end as you say, the 'postfix' pfsense package does more than 'pretty up' the postfix interface. Not least, it provides all the integrated config backup/setup xml config capability, the status/queue monitoring screens, etc. etc.
For those pfsense experts who not doing email managing, here are the key things you need to know:
-
this package is an email router, an email firewall. It is NOT an 'email server' or 'email system'. Think 'branch' not 'leaf'.
-
one of the most powerful things that anti-spam systems use to approve 'legit' email is to check whether the reverse DNS (ip->DNS) matches (DNS->ip) of the system claiming to be the sender of the email. If the system at that IP has a certificate with a CN that matches the DNS, the odds of having outbound email be wrongly marked as spam are less. Way less. PF already supports a cert manager which it needs for its own https purpose that matches the need for a forwarder. The edge router is just 'the right place' for the email router to live as well.
-
any 'real' email install has two or more ISPs or 'WAN' providers. Just think of all the avoidable plumbing necessary to avoid asymmetric routing if the emailer 'store and foreward' point is NATTed downstream of pfsense.
-
internet 'email exchangers' have two or more systems with different IP addresses set up in the DNS. It's a perfect fit for two pf boxes using pfsync. A common admin GUI for both.
I hope this helps motivate those who care mostly about packet routing to comprehend the appropriateness of the postfix package hosted on pfsense.
-
-
https://github.com/pfsense/pfsense/pull/2844
Looks like the Postfix package maybe will arrive with pfSense 2.3.1?
-
Hi Bismarck,
That pull request is marked "Post 2.3.1" now. I guess marcelloc has modified the Postfix Forwarder to use that change, so maybe 2.3.2 or whatever comes next.
I'm considering turning my current pfSense VM into one that only does Postfix Forwarder and using 2.3.1 in a separate VM as the firewall. Easier than setting up a new FreeBSD VM and installing Postfix on it.
-
Hi Biggsy, I will stay with 2.2.6 as long as it has no high risk security vulnerabilities which can't be manually fixed/patched, so no reason to dump a well working UTM just for a fancy GUI. ;)
-
Hi.
In case someone needs to specify a port in domain forwarding, here is a patch for /usr/local/pkg/postfix.inc:
--- postfix.inc.org 2015-10-29 13:59:12.000000000 +0300 +++ postfix.inc 2015-10-29 14:19:36.000000000 +0300 @@ -263,10 +263,17 @@ if (is_array($postfix_domains['row'])) { foreach ($postfix_domains['row'] as $postfix_row) { $relay_domains .= ' ' . $postfix_row['domain']; - if (!empty($postfix_row['mailserverip'])) - $transport .= $postfix_row['domain'] . " smtp:[" . $postfix_row['mailserverip'] . "]\n"; + if (!empty($postfix_row['mailserverip'])) { + if (strrpos($postfix_row['mailserverip'], ":") === false) { + $transport .= $postfix_row['domain'] . " smtp:[" . $postfix_row['mailserverip'] . "]\n"; + } + else { + list($t_ip, $t_port) = explode(":", $postfix_row['mailserverip']); + $transport .= $postfix_row['domain'] . " smtp:[" . $t_ip . "]:" . "$t_port\n"; } } + } + } #check cron check_cron(); #check logging @@ -787,8 +794,15 @@ } else if (substr($key, 0, 12) == "mailserverip" && is_numeric(substr($key, 12))) { if (empty($post['domain' . substr($key, 12)])) $input_errors[] = "Domain for {$value} cannot be blank."; - if (!is_ipaddr($value) && !is_hostname($value)) - $input_errors[] = "{$value} is not a valid IP address or host name."; + if (strrpos($value, ":") === false) { + if (!is_ipaddr($value) && !is_hostname($value)) + $input_errors[] = "{$value} is not a valid IP address or host name."; + } + else { + list($t_ip, $t_port) = explode(":", $value); + if (!is_ipaddr($t_ip) && !is_hostname($t_ip)) + $input_errors[] = "{$value} is not a valid IP address or host name."; + } } } }
Thanks jazzl0ver, patch works perfect! :)
-
En el día de hoy salio pfsense 2.3.1 y aún nada de postfix forwarder, según la propia web de documentación de pfsense, https://doc.pfsense.org/index.php/2.3_Removed_Packages dice lo siguiente Postfix Forwarder - no package maintainer, not converted, en la lista de paquetes removidos. Por fin para cuando volvemos a tener estos paquetes que tanto nos ayudan y resuelven problemas. Muchas gracias.
Today came out pfsense 2.3.1 and still nothing forwarder postfix, according to the website of documentation pfsense, https://doc.pfsense.org/index.php/2.3_Removed_Packages reads Postfix Forwarder - no package maintainer, not converted, removed from the list of packages. Finally when we again have these packages that both help us and solve problems. Thank you very much.
-
Postfix Forwarder - no package maintainer, not converted, removed from the list of packages.
Not true. I've sent the pull request but it's still not verified or something on this direction.
-
So, what's the reason a 'ready to go' pull request for postfix isn't moving ahead? Did someone in high places just forget? Perhaps a friendly ping email to correct the impression of no maintainer??
-
Well, maybe the team was just trying to get 2.3.1 out the door and didn't have the time to look at packages?
-
Hey Marcello - I'm still steamed that pfSense didn't make it more obvious that the upgrade to 2.3 was going to destroy my Postfix installation. >:( I would NEVER have upgraded to 2.3 if I had known that all the work I did to get mail under control was about to be wiped out! I was so grateful to you for providing the port for pfSense; it worked flawlessly once I figured out how to configure it (that took a long time). Now my mail system is flooded with crap again every day. I cannot wait for Postfix to make it back into the 2.3.1 package installer.
Is there any way to download it directly from you/Github and install it manually into pfSense 2.3.1? I'm desperate to get my mail back under control.
Thanks for all your hard work!!
Rob…
-
…pfSense didn't make it more obvious that the upgrade to 2.3 was going to destroy my Postfix installation
You mean more than this?
Packages
The list of available packages in pfSense 2.3.x has been significantly trimmed. We have removed packages that have been deprecated upstream, no longer have an active maintainer, or were never stable. A few have yet to be converted for Bootstrap and may return if converted. See the 2.3 Removed Packages list for details.
But I understand your frustration.
-
Postfix Forwarder - no package maintainer, not converted, removed from the list of packages.
Not true. I've sent the pull request but it's still not verified or something on this direction.
No será cierto, pero es lo que informa la web de pfsense https://doc.pfsense.org/index.php/2.3_Removed_Packages
en estos momentos en que escribo este post dice así Postfix Forwarder - not converted (pending pull request) .
Muchas gracias a la espera de que salga pronto, hay alguna opción para poder instarlo manualmente.It will not be true, but what informs the web of pfsense https://doc.pfsense.org/index.php/2.3_Removed_Packages
right now as I write this post so says Postfix Forwarder - not converted (pending pull request).
Thank you very much waiting to come out soon, there is an option to manually urge. -
45 pages, sorry but i'm not going to wade through that.
Does this do smtp "passthrough" to the internal mail server for when you want to send mail?
I installed postfix on our debian server, and i can get incoming mail from outside mail servers go through postfix/spamassassin, and then to our internal server.
But the problem comes when you want to send mail from a client, when it connects it cannot do authentication (and ldap is insecure, i don't like it), and it says "relay access denied" - which makes sense due to it not being an open relay.
Can this do some kind of passthrough for when doing authentication to go directly to our internal one? -
passthrough is a nat/port forward. postfix is a postfix server. mainly to filter spam and that. =)
"relay access denied" is a wrongly configured postfix. check http://www.postfix.org/documentation.html .
