Postfix - antispam and relay package

marcelloc

This is a common setup while using carp.

You configure the package(squid,snort,dansguardian,etc) to listen only on 127.0.0.1 and then create a nat rule to forward lan,wan,etc Carp address to 127.0.0.1.
This way you keep package running on both boxes without missing inet address startup errors.

If you configure this way on your wan, every time it changes ip, postfix will keep working as it's listening on lo0 and pfsense will keep the forward from wan address to it.

biggsy

Thank you, Marcello. Your explanation was very instructive and helpful.

I guess I've never had a problem because I think the only time my cable IP has changed was when I rebooted pfSense - and that's very infrequent.

elementalwindx

Wish OP would update the original post with newest info so I dont have to go thru 28 pages of whatever to see what the newest changes/versions/etc are of this package…

nekron

Hi …

I've some problem with Postfix Forwarder, it was installed on a new 2.1-RELEASE Install, the previous Version on a 2.1-BETA was functional (due HDD Crash i don't know the version

220 pfsense.xx ESMTP Postfix
HELO xxx
250 pfsense.xxx
MAIL FROM: <michael@xxx>
250 2.1.0 Ok
RCPT TO: <michael@xxx>
450 4.1.1 <michael@xxxx>: Recipient address rejected: unverified address: connect to 172.16.1.254[172.16.1.254]:25: No route to host</michael@xxxx></michael@xxx></michael@xxx>

172.16.1.254 port 25 is reachable from the pfsense-Box !

Best regards,
michael

expert_az

Hello marcelloc,

I'm getting these errors when attempting to query from search mail tab.

instead of query results getting lines below.This happening only query with todays date(15/01/2014),when selecting another date it's working ok.

Warning: sqlite_open(): file is encrypted or is not a database in
/usr/local/www/postfix.php on line 544 Warning: sqlite_query() expects parameter 1 to be resource, string given in
/usr/local/www/postfix.php on line 606 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
/usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
/usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
/usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in
/usr/local/www/postfix.php on line 610 Warning: sqlite_fetch_array() expects parameter 1 to be resource, null given in

in addidion to this problem i'm getting error below when starting,restrating postfix.

php: /status_services.php: The command '/usr/local/etc/rc.d/postfix.sh stop' returned exit code '1', the output was '/usr/pbi/postfix-amd64/sbin/postconf: warning: /usr/pbi/postfix-amd64/etc/postfix/master.cf: unused parameter: user=postfix'

mauricioniñoavella

Hello friends, this is me showing this error. in Package Version 2.10.2 pkg v.2.3.7

I confirm if Postfix - antispam and relay package, can confirgurar with tls

this is the error

February 3 12:23:57 postfix / smtp [40769]: instead, send to (port submission/587) WITH STARTTLS
February 3 12:23:57 postfix / smtp [40769]: CLIENT wrappermode (port smtps/465) is unimplemented

So I have add to main.cf:

smtp_sasl_auth_enable = yes
relayhost = [smtp.xxx.xx]: 465
smtp_sasl_password_maps = hash :/ etc / postfix / sasl_passwd
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_mandatory_protocols =

Thanks for you colaboration.

Mauricio Niño Avella.

ics

Hi,

I have multifuntion printers used for scan to email.
Is it possible to configure postfix/postscreen to not reply "service currently unavailable" at the first connection of these MFP without allowing them to relay to internet ?
I mean I don't want to add the IPs in the MyNetworks list because it also allows these IPs to relay to internet.

Thanks

yaboc

hi Marcello

using this great tool and having some issues with the some good mails discarded by header checks because of mis-configured sender's server.

Feb 12 15:57:11 postfix/smtpd[10780]: connect from ms1.cernerasp.com[159.140.193.46]
Feb 12 15:57:11 postfix/smtpd[10780]: NOQUEUE: reject: RCPT from ms1.cernerasp.com[159.140.193.46]: 550 5.7.1 <taspmomail01.cmsext.com>: Helo command rejected: Host not found; from= infoviewreport@hvhc.orgto= me@mydomain.comproto=ESMTP helo= <taspmomail01.cmsext.com>Feb 12 15:57:16 postfix/smtpd[10780]: disconnect from ms1.cernerasp.com[159.140.193.46]

is there an easy workaround without disabling the spam checks? thanks

yaboc</taspmomail01.cmsext.com>/me@mydomain.com /infoviewreport@hvhc.org</taspmomail01.cmsext.com>

biggsy

Best thing to do is have the admin for that mail server fix the DNS entry but you could try adding this to your Access Lists, Header section:

/^From:.*@hvhc.org/ OK

informatica_cmav

Hello everybody,

We have postfix forwarder working for 1 year, yesterday I update pfsense from 2.0.1 to 2.1 and reinstall postfix. Today we do not receive external mails, in the maillog we have "Recipient address rejected: unverified address" in all msgs.

I search the forums and change the listen interfaces to loopback and create a nat to forward the traffic on port 25 from WAN to loopback. But the problem persists.

I found a topic (https://forum.pfsense.org/index.php/topic,70541.0.html) that says that I need to configure something on Recipient tab, I really don´t have anything on this tab before.

My questions are :

With the update to postfix forwarder 2.10.2 pkg v.2.3.7 it is mandatory to put the list of mail in Recipients?
We work with Zimbra the LDAP fetch can be used with non AD enviroment?

Thanks a lot

yaboc

@biggsy:

Best thing to do is have the admin for that mail server fix the DNS entry but you could try adding this to your Access Lists, Header section:
/^From:.*@hvhc.org/ OK

i did add it and it's still dropping the mail sporadically. they company is using 3rd party server with their email as sender and i keep having problems with it. emails from their onsite server are coming in fine. so that be a misconfiguraed server. is disabling helo checks bad idea? it's becoming an issue now but i dont want to open doors to hell. i have a couple other mails that are good but i think their mail servers might be misconfigured. should i scan their domain with mx tool for mx server names and add those to "helo" part of access list ?

Bittone66

Hello Guys,
I have been using Postfix Forwarder for more than a year with great success.
Now I moved the Pfsense VM to another server, upgraded to 2.1 and I have this problem:


Mar  5 18:38:08 pfsense postfix/smtpd[25953]: connect from www.archidata.it[87.241.18.18]
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:08 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: NOQUEUE: reject: RCPT from www.archidata.it[87.241.18.18]: 450 4.1.1 <xxxx@alfa.it>: Recipient address rejected: unverified address: connect to 172.16.16.20[172.16.16.20]:25: Operation timed out; from= <xxxxxx@archidata.it>to= <xxxxxx@alfa.it>proto=ESMTP helo= <www.archidata.it>Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:09 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: warning: connect to private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: warning: problem talking to server private/anvil: Connection refused
Mar  5 18:38:10 pfsense postfix/smtpd[25953]: disconnect from www.archidata.it[87.241.18.18]</www.archidata.it></xxxxxx@alfa.it></xxxxxx@archidata.it></xxxx@alfa.it>

Looks similar to a previous problem in this forum flow, so I tried forwarding to localhost and setting Postifx to listen on localhost but the error remains.

Now I'm forwarding directly to the DMZ in order to have email delivered (yes, the real mail server listens and works on 172.16.16.20:25).
I did not setup the LDAP verification of recipient since I'll leave it to the mail server (no problem with load).
One more thing: I disabled anvil and always get the anvil communication error.
I already removed and re-installed the forwarder 3 times with no success.
Thanks for your kind attention and support

Alberto

Bittone66

Hello,
I took a alook at the enrated main.cf and, as far as I know, the entire section on smtpd_recipient_restrictions should not be there since my reicipient tab is empty and this is just a relay server.

Is there a way to tell the package not to write the whole section?
Thanks

Alberto

marcelloc

@Bittone66:

this is just a relay server.

Inbound or outbound?

@Bittone66:

Is there a way to tell the package not to write the whole section?

you can edit snort.inc and comment this part.

tfjelde

Hi all

I'm trying to get the mail search to work with no luck.

All setting are correct as fare as i know

Loggin Destination to /var/log/maillog
Update Sqlite frequency every minute
and i have inlcude /^Subject:/ WARN line in Acl Headers

doing a tail -f /var/log/maillog shows lines like this
postfix/cleanup[22445]: 9249F114D0: warning: header Subject: test from mail.####.no

But no other db files than postscreen_cache.db and verify_cache.db
is showing up in /var/db/postfix

2.1-RELEASE (i386)
built on Wed Sep 11 18:16:22 EDT 2013
FreeBSD 8.3-RELEASE-p11
Postfix 2.10.2 pkg v.2.3.7

Any suggestions on what to try next ?

Bittone66

Hi Marcello,
thanks for your kind attention.
It's juts an inboud relay to block spammers, I'm not uysing it as outbound relay.
One update: I removed the recipient section by editing postfx.inc file, still the problem of postfix not being able to communicate to the destination server on port 25 remains.
So I used the portforward to localhost and everything started working again.
Would you accept a "feature request" here like adding a "Don't verify recipients" checkbox to the interface in order not to generate thet part of the main.cf?
Bye

Alberto

JJYVON

Hi

Thanks Marcello for this great package.

someone can help me with the mail search function ?
I have made the configuration

To use Diagnostics -> Search mail you need to:
Select Loggin Destination to /var/log/maillog (done)
Select update Sqlite frequency (every minute)
Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules (done)

.

In my var log i have the WARN for header

Apr 10 09:35:32 disbox-utm postfix/cleanup[9968]: D117313C4F4: warning: header Subject:

and some NOQUEUE

Apr 10 09:35:52 disbox-utm postfix/postscreen[8797]: NOQUEUE: reject: RCPT

yyyy-mm-dd.db are created in /var/db/postfix/ but they are empty

I dont understand what i'm doing wrong

Thanks for your help !

marcelloc

check if cron is set and try to run it on console.

JJYVON

Hi marcelloc
@marcelloc:

check if cron is set and try to run it on console.

My cron is empty

where is the commande i need to run in console

I have another question can i modify the message add to every mail

Ce message a été vérifié par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a été trouvé.
MailScanner remercie transtec pour son soutien.

[update]

I have found the command normaly created with the GUI
I have found where i can edit the MailScanner
I think i have an issue with the interface when i modify something in the configuration, nothing change
I have add the LDAP in recipients no cron was created

My version of pfSENSE is : 2.1.2-RELEASE (amd64)
with this packages:

Postfixe Forwarder is 2.10.2 pkg v.2.3.7
MailScanner 4.84.6 pkg v.0.2.4
HAVP Antivirus 0.91_1 pkg v1.01
Squid3 0.91_1 pkg v1.01
squidGuard-squid3 1.4_4 pkg v.1.9.5

I think i have an issu with the GUI

Thanks.

dneuhaeuser

Hi,

I think I found a small bug in the current version of the postfix forwarder package.

If I set postfix to only listen on my WAN interface, I get a not working configuration:

The connection to my internal mailserver is refused, although everything else is configured right and the mailserver is in fact reachable!
The log states "relay=none" (??)

–--
Apr 18 17:41:03 fw postfix/smtp[40257]: connect to 192.168.135.10[192.168.135.10]:25: Connection refused
Apr 18 17:41:03 fw postfix/smtp[40257]: 8FAAE3C04BA: to=administrator@mydomain.de, relay=none, delay=566, delays=566/0.01/0.02/0, dsn=4.4.1, status=deferred (connect to 192.168.135.10[192.168.135.10]:25: Connection refused)
–--

If I select "Listen on all interfaces/ip addresses" instead, it starts working and the mails are delivered:

–--
Apr 18 17:50:53 fw postfix/postfix-script[921]: refreshing the Postfix mail system
Apr 18 17:50:53 fw postfix/master[9869]: reload – version 2.10.2, configuration /usr/pbi/postfix-i386/etc/postfix
Apr 18 17:50:53 fw postfix/master[9869]: warning: service 25: ignoring inet_interfaces change
Apr 18 17:50:53 fw postfix/master[9869]: warning: to change inet_interfaces, stop and start Postfix
Apr 18 17:50:53 fw postfix/qmgr[1595]: 8FAAE3C04BA: from=the@sender.de, size=236, nrcpt=1 (queue active)
Apr 18 17:50:54 fw postfix/smtp[2007]: 8FAAE3C04BA: to=administrator@mydomain.de, relay=192.168.135.10[192.168.135.10]:25, delay=1156, delays=1156/0.01/0.03/0.51, dsn=2.6.0, status=sent (250 2.6.0 0a3df1d7-0ec3-4338-ad9d-7bdd1509cc6f@SBS2011.company.local [InternalId=7375] Queued mail for delivery)
–--

BUT only until the next RESTART of postfix service!

Then I get this error:

–---
Apr 18 17:53:07 fw postfix/postfix-script[26351]: starting the Postfix mail system
Apr 18 17:53:07 fw postfix/master[26926]: fatal: /usr/pbi/postfix-i386/etc/postfix/master.cf: line 1: no valid IP address found: 25
Apr 18 17:53:08 fw postfix/master[26649]: fatal: daemon initialization failure
Apr 18 17:53:09 fw postfix/postfix-script[27153]: fatal: mail system startup failed
–---

The problem could be that the parameter "inet_interfaces" in main.cf is set to an empty value.
Shouldn't this be set to "all" in this case?

A currently working setup for me is to select all three "LAN + WAN + loopback" as listen interfaces!

In an older version of postfix package this wasn't necessary.

Regards
Dennis/administrator@mydomain.de /the@sender.de /administrator@mydomain.de