Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Postfix - antispam and relay package

    Scheduled Pinned Locked Moved
    pfSense Packages
    136
    855
    926.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      brokendash
      last edited by

      This might be off topic but I'm using this package to relay mail into and then outside of my network both using ipv4 and ipv6. I was wondering if there would be a way to change the webgui config's logic so that if you do not select an interface to listen to it would essentially populate the master.cf using one smtp service entry in the master.cf

      ie:
      smtp      inet  n      -      n      -      1      postscreen

      I think technically using postscreen for inbound traffic & relaying outbound is not the correct method to implement but with my tiny MX environment I feel it's not an issue.

      My setup also has the custom main.cf rules form filled in with the following also…

      relayhost = [smtp.somewhere.net]
      inet_protocols = all
      inet_interfaces = 127.0.0.1, [::1], 192.168.1.254, [fd00:470:bce0:1::254]
      smtp_bind_address = 0.0.0.0
      smtp_bind_address6 = fd00:470:bce0:1::254

      Every time I update to a recent snapshot it seems that I've had to resave all settings in the webgui, then hand tune the master.cf,  copy it and the rest of the /usr/local/etc/postfix/* configs over to the /usr/pbi/postfix-i386/etc/postfix dir. I essentially came to all of these a good while back when I moved from the stable release to a snapshot build and discovered everything was horridly broke…. :-)

      My question now is basically, are there any plans to make this a bit more ipv6 friendly? and could I get some thoughts on the postscreen for in/out relaying as well? Perhaps there is some future changes that will ease my frustrations and/or I'm all for even assisting in the creation any changes.

      Cheers,
      Brian

      1 Reply Last reply Reply Quote 0
      • T
        Truster
        last edited by

        Hello Marcelloc, nice to see you again in another thread :-)

        i have a little question about the postfix forwarder package, i'm getting the errro:

        postfix/postfix-script[21723]: fatal: the Postfix mail system is not running

        And another one: the file /usr/local/etc/rc.d/postfix.sh isn't executable, is this correct?

        Best regards from Salzburg
        Dave

        Edit: Running on pfsense 2.0.2 i386, i'll upgrade it today at 12:00 CEST to the latest version

        1 Reply Last reply Reply Quote 0
        • T
          Truster
          last edited by

          Truster, you are the greatest noop on this planet: check "Enable Postfix"-checkbox and get lucky.  ;D

          1 Reply Last reply Reply Quote 0
          • A
            aslan1071
            last edited by

            Quick question. I hope it has not been covered and I missed it I am sorry as am new to this tool. I have several Cpanel Boxes with several hundred domains on each that I would like to use this for. The Problem comes when I try to add more then 98 domains to the forwarding table it stops adding them. Is this a limit of postfix or pfSense? Please advise.

            thanks

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @aslan1071:

              Quick question. I hope it has not been covered and I missed it I am sorry as am new to this tool. I have several Cpanel Boxes with several hundred domains on each that I would like to use this for. The Problem comes when I try to add more then 98 domains to the forwarding table it stops adding them. Is this a limit of postfix or pfSense? Please advise.

              thanks

              IIRC This limit is on package framework.

              try this:

              • create a backup for phg_edit.php

              • edit it and change lines you find for($x=0; $x<99; $x++) to for($x=0; $x<999; $x++)

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • B
                biggsy
                last edited by

                Aslan1071,

                Are you adding all those entries manually?

                With the postmap command you should be able add them from a text file to /usr/local/etc/postfix/transport.db

                1 Reply Last reply Reply Quote 0
                • A
                  aslan1071
                  last edited by

                  Thanks Guys… I will give this a try. I have tried both methods by had and from text file but it was cutting off the list at 98 no matter the input method.

                  I will let you know if this works.

                  thanks again.

                  1 Reply Last reply Reply Quote 0
                  • D
                    DQM
                    last edited by

                    Dear Marcello,

                    I have just installed PF 2.10 on new my box (2.0.3). But it seems not work with Active Directory ( I didn't see the adexport.pl file at /usr/local/etc/postfix).

                    Could you please show me how does it work with Active Directory to export recipients to the relay_recipients file?

                    Thank you and look forward to your reply.
                    DQM

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      adexport.pl stays on /usr/local/bin/ but you need first to install p5-perl-ldap package.

                      You can install it with pkg_add from my repo or from freebsd repo

                      amd64
                      pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/p5-perl-ldap-0.4300.tbz

                      i386
                      pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/p5-perl-ldap-0.4300.tbz

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • D
                        DQM
                        last edited by

                        Thanks Marcello,

                        It works well now  :)

                        1 Reply Last reply Reply Quote 0
                        • J
                          JohnConnor
                          last edited by

                          Hi Marcelloc,

                          First thanks for your great job

                          I just want to ask you something, I have an issue in the configuration of the forwarding domains.
                          I have three domains to relay to my mailserver, but when I add them in the GUI, click save, it save only the last domain.
                          I tried to add them manually in the transport and main.cf file, but the change does not appear in the GUI

                          I have this issue in both i386/x64 release of pfsense 2.1
                          Postfix forwarder  2.10.0 pkg v.2.3.6

                          Do you have an idea ?

                          Regards
                          John

                          EDIT:
                          I found the problem is internet explorer.
                          Everything works with chrome, sorry for my mistake

                          1 Reply Last reply Reply Quote 0
                          • K
                            kwaci
                            last edited by

                            @kwaci:

                            Hi All,

                            Im new in this forum. Im just installing pfSense with Postfix and Mailscanner package as SMTP relay for our Exchange 2003 server.
                            It work very well. Postscreen and RBL checks are the day saver.  :)

                            Thank you

                            Hi All and marcelloc,

                            It has been four months since i`m using this antispam and relay package.
                            And it still work very well.

                            Thank you  pfSense and marcelloc for creating such a good system.

                            tips : keep the maillog file rotated

                            1 Reply Last reply Reply Quote 0
                            • B
                              brokendash
                              last edited by

                              Any plans for some ipv6 support? also everytime I reboot I have to manually replace my master.cf config and restart the service…

                              I need postfix to listen on ipv6 so with no interfaces selected the within the web gui the /usr/pbi/postfix-i386/etc/postfix/master.cf ends up getting modified adding my wan ip info.

                              MY.WAN.IP:25 inet  n      -      n      -      1      postscreen

                              This means every reboot postfix starts up only listening to my a single address….

                              Im simply desiring the web gui to allow for one to select no interfaces allowing for the master.cf to contain the single smtp option.

                              smtp     inet  n      -      n      -      1      postscreen

                              This would essentially allow for my other ipv6 config details to be configured within the web gui's custom main.cf options area….

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                @brokendash:

                                Im simply desiring the web gui to allow for one to select no interfaces allowing for the master.cf to contain the single smtp option.

                                I'll put it on my todo list.

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  Done! :)

                                  Install/upgrade to 2.10.2 pkg v.2.3.7  postfix-forward package version.

                                  Do not forget to revise config tabs after upgrade.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    biggsy
                                    last edited by

                                    Hi Marcello,

                                    Since updating to 2.10.2 pkg v.2.3.7 no mail relayed and seeing these messages in the log:

                                    Dec  8 06:57:44 postfix/smtp[2973]: connect to 192.168.11.2[192.168.11.2]:25: Operation timed out
Dec  8 06:57:44 postfix/smtp[2973]: 7AC81B934: to=<me@my.domain>, relay=none, delay=1065, delays=1035/0.01/30/0, dsn=4.4.1, status=deferred (connect to 192.168.11.2[192.168.11.2]:25: Operation timed out)</me@my.domain>

                                    Have restarted postfix many times and tried both "IPv4 only" and "all" options.  Reinstalled, no change.

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      Can you post part of main.cf(interface section) and output of netstat -an | grep -i listen?

                                      Pfsense 2.1?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        biggsy
                                        last edited by

                                        Thanks.

                                        Yes, 2.1-RELEASE (amd64) built on Wed Sep 11 18:17:48 EDT 2013

                                        Not sure what you mean by "interface section".  Here is a sanitized version of main.cf:

                                        /usr/pbi/postfix-amd64/etc/postfix/main.cf
#main.cf\
#Part of the Postfix package for pfSense
#Copyright (C) 2010 Erik Fonnesbeck
#Copyright (C) 2011-2013 Marcello Coutinho
#All rights reserved.
#DO NOT EDIT THIS FILE

mynetworks = /usr/pbi/postfix-amd64/etc/postfix/mynetwork_table
mynetworks_style = host
access_map_reject_code= 554
access_map_defer_code = 451
unverified_recipient_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
myhostname = <mail.my.domain>
bounce_queue_lifetime = 0s
postscreen_cache_retention_time = 30d
anvil_status_update_time = 1h
notify_classes = protocol
relay_domains = <first.domain> <second.domain>
transport_maps = hash:/usr/pbi/postfix-amd64/etc/postfix/transport
local_recipient_maps =
mydestination =
mynetworks_style = host
message_size_limit = 30000000
default_process_limit = 100
disable_vrfy_command = yes
strict_rfc821_envelopes = yes

#Just reject after helo,sender,client,recipient tests
smtpd_delay_reject = yes

# Don't talk to mail systems that don't know their own hostname.
smtpd_helo_required = yes
smtpd_helo_restrictions = check_helo_access pcre:/usr/pbi/postfix-amd64/etc/postfix/helo_check,
				reject_unknown_helo_hostname,
				reject_invalid_helo_hostname,
				reject_non_fqdn_helo_hostname,
				permit

smtpd_sender_restrictions = reject_non_fqdn_sender,
				reject_unknown_sender_domain,
				reject_unauth_pipelining,
				reject_multi_recipient_bounce,
				permit

# Allow connections from specified local clients and strong check everybody else.								
smtpd_client_restrictions = permit_mynetworks,
				reject_unauth_destination,
				check_client_access pcre:/usr/pbi/postfix-amd64/etc/postfix/cal_pcre,
				check_client_access cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr,
				reject_unknown_client_hostname,
				reject_unauth_pipelining,
				reject_multi_recipient_bounce,
				permit							

smtpd_recipient_restrictions = permit_mynetworks,
				reject_unauth_destination,
				reject_unauth_pipelining,
				check_client_access pcre:/usr/pbi/postfix-amd64/etc/postfix/cal_pcre,
				check_client_access cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr,
				check_sender_access hash:/usr/pbi/postfix-amd64/etc/postfix/sender_access,
				reject_non_fqdn_helo_hostname,
				reject_unknown_recipient_domain,
				reject_non_fqdn_recipient,
				reject_multi_recipient_bounce,
				reject_unverified_recipient,
				permit

inet_protocols = ipv4
inet_interfaces = <my.public.ip>
postscreen_disable_vrfy_command = yes
postscreen_non_smtp_command_enable = yes
postscreen_non_smtp_command_action = enforce
postscreen_pipelining_enable = yes
postscreen_pipelining_action = enforce
postscreen_bare_newline_enable = yes
postscreen_bare_newline_action = enforce
postscreen_greet_action = enforce
postscreen_access_list = permit_mynetworks,
			cidr:/usr/pbi/postfix-amd64/etc/postfix/cal_cidr
postscreen_dnsbl_action= enforce
postscreen_blacklist_action= enforce</my.public.ip></second.domain></first.domain></mail.my.domain>

                                        and netstat output:

                                        
tcp4       0      0 <my.public.ip>.25       *.*                    LISTEN
tcp6       0      0 *.53                   *.*                    LISTEN
tcp4       0      0 *.53                   *.*                    LISTEN
tcp6       0      0 *.443                  *.*                    LISTEN
tcp4       0      0 *.443                  *.*                    LISTEN
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN</my.public.ip>
                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          biggsy
                                          last edited by

                                          I've been running WireShark on the mail server.  As expected, no connections to port 25.

                                          May not be relevant but I just found these in syslog:

                                          
Dec  8 06:57:15 postfix/master[12027]: warning: ignoring inet_protocols parameter value change
Dec  8 06:57:15 postfix/master[12027]: warning: old value: "all", new value: "ipv4"
Dec  8 06:57:15 postfix/master[12027]: warning: to change inet_protocols, stop and start Postfix
                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            That's why I have changed field info warning to restart postfix daemon after changing inet protocol or ip.

                                            Netstat and config shows it listening on public address.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post