Postfix - antispam and relay package

marcelloc · Jan 7, 2013, 1:30 PM

try to create these missing folders and permissions.

chris32lr · Jan 8, 2013, 6:43 PM

Marcelloc,

Thank you so much for taking the time to put this package together and help so many of us. Being new to PFSense, I just want to make sure I configure it properly because this is our only firewall. Here's what I'm a little concerned about:

1. Right now I have a NAT Port Forward configured as:
Interface: WAN
Protocol: TCP
Destination: WAN Address
Destination Port: SMTP
Redirect Target IP: My internal exchange server IP
Redirect Target Port: SMTP
- I read here: http://forum.pfsense.org/index.php/topic,46196.0.html you say "remember to remove nat from port 25 and allow access on wan firewall rules to postfix." So I delete this port forward? If so, can you tell me how to properly configure the rule such as the Interface, Protocol, Source, Destination, etc.?

Thanks again!!

marcelloc · Jan 9, 2013, 3:47 AM

Just take a look on current rule your nat has created and replace internal destination IP to wan address.

Make sure your Postfix is configured and running before using it with real traffic.

chris32lr · Jan 9, 2013, 1:45 PM

@marcelloc:

Just take a look on current rule your nat has created and replace internal destination IP to wan address.

Make sure your Postfix is configured and running before using it with real traffic.

Thank you! :)

Ludo · Jan 10, 2013, 4:16 PM

Hi,

I have Pfsense version 2.0.1 and I just installed postfix package.
I do that because i need a relay smtp.
I have many temporary users on my network. They all have an Internet access provider different (Orange, Free, etc …).
I can not change the configuration in their smtp mailer.
This is why I would like to add a rule on my router so they can all go through the SMTP server of my ISP.
Can you do it with your package postfix?
Thank you in advance.

@marcelloc:

Hi all,

I've just finished postfix package version 2.3.

Postfix is an amazing mail forwarder that really keep away any misconfigured server or server trying to forge email.
Postfix Forwarder package at pfsense has many antispam features but for now, no SASL support for remote authentication.

Zombie blocker (postscreen)

Header chekcs

Body checks

Access lists

RBL checks

SPF checks

Dashboard widgets with mail stats

Sqlite logs support

Sqlite logs forward to use only one box to search mail

Package permissions to allow users to just search mail or view queue

Search mail tool

view postfix queue in gui

And you can also use an third part antispam engine like mailscanner or policyd v2 for a complete antispam solution.

note: NEVER try to install policydv2 freebsd package, it will break out your pfsense.
if you plan to use policydv2 you must put it on other server or in a jail.

The mailscanner tutorial(or package) is under development, for now you can configure by hand using pkg_add -r MailScanner.

att,
Marcello Coutinho

marcelloc · Jan 11, 2013, 1:45 AM

@Ludo:

This is why I would like to add a rule on my router so they can all go through the SMTP server of my ISP.
Can you do it with your package postfix?

I think you will need authentication for these clients.

You can manually install and configure sasl as current version does not has this integrations on gui.

Ludo · Jan 11, 2013, 10:50 AM

@marcelloc:

@Ludo:

This is why I would like to add a rule on my router so they can all go through the SMTP server of my ISP.
Can you do it with your package postfix?

I think you will need authentication for these clients.

You can manually install and configure sasl as current version does not has this integrations on gui.

ok, thank you!

Redtooth · Jan 17, 2013, 8:50 PM

Hi

I've just installed postfix, everything is working fine except an error keeps feeling my logs..

Jan 17 19:20:26
postfix/smtpd[25463]: D17FD62D47C: client=addmail.nu[212.247.84.186]
Jan 17 19:20:26
postfix/cleanup[28013]: D17FD62D47C: message-id=729443A7-32CE-41B4-A908-11E46BA2CBD9@site.se
Jan 17 19:20:26
postfix/qmgr[46843]: D17FD62D47C: from=firstname.lastname@site.se, size=1225, nrcpt=1 (queue active)
Jan 17 19:20:27
postfix/smtp[28014]: D17FD62D47C: to=myname@mydomain.org, relay=10.10.1.100[10.10.1.100]:25, delay=0.2, delays=0.03/0.01/0.02/0.13, dsn=2.0.0, status=sent (250 Queued (0.016 seconds))
Jan 17 19:20:27
postfix/qmgr[46843]: D17FD62D47C: removed
Jan 17 19:20:31
postfix/smtpd[25463]: warning: connect to private/anvil: Connection refused
Jan 17 19:20:31
postfix/smtpd[25463]: warning: problem talking to server private/anvil: Connection refused
Jan 17 19:20:32
postfix/smtpd[25463]: warning: connect to private/anvil: Connection refused
Jan 17 19:20:32
postfix/smtpd[25463]: warning: problem talking to server private/anvil: Connection refused
Jan 17 19:20:32
postfix/smtpd[25463]: disconnect from addmail.nu[212.247.84.186]

Any clue how to fix this?

** SOLVED **
Had to have Anvil Daemon enabled in Postfix Forwarder under AntiSpam for the problem to go away./myname@mydomain.org /firstname.lastname@site.se

RChadwick · Mar 1, 2013, 4:55 PM

Can you tell me if this can forward to a port besides 25? I have pfsense at work, and I run an email server at home, but Comcast just decided to block port 25. Was hoping to configure the mx records to point to my office, and it would forward all mail to my home email server.

marcelloc · Mar 1, 2013, 5:43 PM

@RChadwick:

Can you tell me if this can forward to a port besides 25? I have pfsense at work, and I run an email server at home, but Comcast just decided to block port 25. Was hoping to configure the mx records to point to my office, and it would forward all mail to my home email server.

It will not filter based ou source ip as all your mail will have your comany address as source.

vbela · Mar 16, 2013, 5:44 PM

@mrfairsquare:

ISSUE:
–-----
The postfix log db file is empty, and postfix does not or can not write to the db file.

Location i'm looking at: /var/db/postfix

I have the same problem.

Loggin is turned on
Destination /var/log/maillog
Update Sqlite Every minute
/^Subject:/ WARN is in the right place

But mail search is not working. DB is created, but it's empty ((

Pfsense ver 2.0.2 i386

marcelloc · Mar 19, 2013, 2:04 PM

@vbela:

But mail search is not working. DB is created, but it's empty ((

What you get on postfix logs? Can you see the subject warn message on logs and postfix database script on cron?

biggsy · Apr 5, 2013, 7:01 AM

I've set up a new VM to try and test Postfix and some other packages.

2.1-BETA1 (amd64) built on Tue Apr 2 16:21:22 EDT 2013 + Postfix 2.8.7,1 pkg v.2.3.4_1

Two things noticed so far:

Still need to copy files as per this post: http://forum.pfsense.org/index.php/topic,50519.msg270803.html#msg270803
When restarting the ESXi host and pfSense VM, Postfix doesn't pick up a change of WAN IP address. Given error is: postfix/master[32735]: fatal: bind <old wan="" ip="">port 25: Can't assign requested address. Probably because master.cf is being updated in /usr/local/etc/postfix/ not /usr/pbi/postfix-amd64/etc/postfix</old>

Edit: one more thing at start of package:

postfix/postfix-script[55357]: warning: not owned by root: /var/spool/postfix

biggsy · May 6, 2013, 8:38 AM

The two main problems noted above now seem to be fixed with the latest version for pfSense 2.1 (amd64).
Thank you marcelloc.

The last point, about /var/spool/postfix is still there but never caused any problems.

Just as an aside, I also discovered that I could copy the /var/db/postfix/postscreen_cache.db file from the existing 32-bit 2.0.2 install to the new 64-bit 2.1 Beta1 install.

To avoid delayed delivery of all those "once every few weeks emails", I have a custom main.cf entry:```
postscreen_cache_retention_time = 30d


Copying the postscreen_cache file saves having the new install re-learn all the whitelisted SMTP client IPs that the existing install knew about.

marcelloc · May 7, 2013, 11:21 AM

biggsy,

Thanks for your feedback :)

ics · May 7, 2013, 5:07 PM

Hi All,

I've just updated package mailscanner-dev to v4.84.5_3 and upgraded pFsense to v2.0.3.
Now memory usage is very high. I don't know if it's due to package or pfsense update.
Postfix processes take very high memory (screen captures of sys activity in old and new version attached).

Do have an idea ?

Thanks

marcelloc · May 7, 2013, 5:14 PM

It's a normal behavior. You have low memory machines.

ics · May 8, 2013, 6:00 AM

Thank you Marcelloc

Indeed I have 1024MB.
But why processes use so much memory now ?
This is a huge difference !

biggsy · May 12, 2013, 1:26 AM

A strange new problem today with postfix forwarder on 2.1BETA amd64 test system. Config hadn't changed.

Received the following error:


postfix/smtpd[1783]: error: open /usr/local/etc/postfix/helo_check: No such file or directory
postfix/smtpd[1783]: connect from [i]mailserver.myisp[/i].com[[i]x.y.z.231]
postfix/smtpd[1783]: warning: pcre:/usr/local/etc/postfix/helo_check is unavailable. open /usr/local/etc/postfix/helo_check: No such file or directory
postfix/smtpd[1783]: warning: pcre:/usr/local/etc/postfix/helo_check: table lookup problem

~~EDIT: looks like it should be "helo_check_s_"~~

dhatz · May 12, 2013, 3:04 AM

Is the per process memory usage of 200M+ normal ?

I haven't used mailscanner before (just visited their website and they list some impressive installations), but for the past 6-7 years I have been running several Postfix systems using amavis to interface with antispam (spamassassin) and antiviruses (e.g. clamav) and postgrey and the overall memory usage is nowhere near those numbers …