Postfix - antispam and relay package
-
Thank you for working on this, Marcello. Is there any news?
yes, I'll need to change the syslog function that enables /var/log/maillog.
Dear, Marcello.
I have a problem.
She described https://forum.pfsense.org/index.php?topic=110620.0You are given a solution to the problem. I executed the command
fetch -o /usr/local/www/postfix.php http://e-sac.siteseguro.ws/px22/postfix.txt
fetch -o /usr/local/www/widgets/widgets/postfix.widget.php http://e-sac.siteseguro.ws/px22/postfix.widget.txt
I have not changed. :'(
-
postfix is postfix, if you really need it functional, scp /your/config/files/* root@newserver:/your/new/config/files/
works…
you can check logs with cat /var/log/maillog | grep whatyouwanttosearchherethere is no point on complaining and saying that pfsense is a bad product or is no longer a UTM or all that 'sadness' (for not saying another word) trying to make the developers feel bad for you guys. they will fix it at some point. if you cant live without the graphical interface, set a VM, some forwarding rules and run it from there.
if you are unhappy, get a grip and start coding a patch yourself apply it, test it and share it here. any volunteer? ;)
-
if you guys are anxious on getting postfix you should install the package, its a bsd system at the end.
While indeed it's a bsd system at the end as you say, the 'postfix' pfsense package does more than 'pretty up' the postfix interface. Not least, it provides all the integrated config backup/setup xml config capability, the status/queue monitoring screens, etc. etc.
For those pfsense experts who not doing email managing, here are the key things you need to know:
-
this package is an email router, an email firewall. It is NOT an 'email server' or 'email system'. Think 'branch' not 'leaf'.
-
one of the most powerful things that anti-spam systems use to approve 'legit' email is to check whether the reverse DNS (ip->DNS) matches (DNS->ip) of the system claiming to be the sender of the email. If the system at that IP has a certificate with a CN that matches the DNS, the odds of having outbound email be wrongly marked as spam are less. Way less. PF already supports a cert manager which it needs for its own https purpose that matches the need for a forwarder. The edge router is just 'the right place' for the email router to live as well.
-
any 'real' email install has two or more ISPs or 'WAN' providers. Just think of all the avoidable plumbing necessary to avoid asymmetric routing if the emailer 'store and foreward' point is NATTed downstream of pfsense.
-
internet 'email exchangers' have two or more systems with different IP addresses set up in the DNS. It's a perfect fit for two pf boxes using pfsync. A common admin GUI for both.
I hope this helps motivate those who care mostly about packet routing to comprehend the appropriateness of the postfix package hosted on pfsense.
-
-
https://github.com/pfsense/pfsense/pull/2844
Looks like the Postfix package maybe will arrive with pfSense 2.3.1?
-
Hi Bismarck,
That pull request is marked "Post 2.3.1" now. I guess marcelloc has modified the Postfix Forwarder to use that change, so maybe 2.3.2 or whatever comes next.
I'm considering turning my current pfSense VM into one that only does Postfix Forwarder and using 2.3.1 in a separate VM as the firewall. Easier than setting up a new FreeBSD VM and installing Postfix on it.
-
Hi Biggsy, I will stay with 2.2.6 as long as it has no high risk security vulnerabilities which can't be manually fixed/patched, so no reason to dump a well working UTM just for a fancy GUI. ;)
-
Hi.
In case someone needs to specify a port in domain forwarding, here is a patch for /usr/local/pkg/postfix.inc:
--- postfix.inc.org 2015-10-29 13:59:12.000000000 +0300 +++ postfix.inc 2015-10-29 14:19:36.000000000 +0300 @@ -263,10 +263,17 @@ if (is_array($postfix_domains['row'])) { foreach ($postfix_domains['row'] as $postfix_row) { $relay_domains .= ' ' . $postfix_row['domain']; - if (!empty($postfix_row['mailserverip'])) - $transport .= $postfix_row['domain'] . " smtp:[" . $postfix_row['mailserverip'] . "]\n"; + if (!empty($postfix_row['mailserverip'])) { + if (strrpos($postfix_row['mailserverip'], ":") === false) { + $transport .= $postfix_row['domain'] . " smtp:[" . $postfix_row['mailserverip'] . "]\n"; + } + else { + list($t_ip, $t_port) = explode(":", $postfix_row['mailserverip']); + $transport .= $postfix_row['domain'] . " smtp:[" . $t_ip . "]:" . "$t_port\n"; } } + } + } #check cron check_cron(); #check logging @@ -787,8 +794,15 @@ } else if (substr($key, 0, 12) == "mailserverip" && is_numeric(substr($key, 12))) { if (empty($post['domain' . substr($key, 12)])) $input_errors[] = "Domain for {$value} cannot be blank."; - if (!is_ipaddr($value) && !is_hostname($value)) - $input_errors[] = "{$value} is not a valid IP address or host name."; + if (strrpos($value, ":") === false) { + if (!is_ipaddr($value) && !is_hostname($value)) + $input_errors[] = "{$value} is not a valid IP address or host name."; + } + else { + list($t_ip, $t_port) = explode(":", $value); + if (!is_ipaddr($t_ip) && !is_hostname($t_ip)) + $input_errors[] = "{$value} is not a valid IP address or host name."; + } } } }
Thanks jazzl0ver, patch works perfect! :)
-
En el día de hoy salio pfsense 2.3.1 y aún nada de postfix forwarder, según la propia web de documentación de pfsense, https://doc.pfsense.org/index.php/2.3_Removed_Packages dice lo siguiente Postfix Forwarder - no package maintainer, not converted, en la lista de paquetes removidos. Por fin para cuando volvemos a tener estos paquetes que tanto nos ayudan y resuelven problemas. Muchas gracias.
Today came out pfsense 2.3.1 and still nothing forwarder postfix, according to the website of documentation pfsense, https://doc.pfsense.org/index.php/2.3_Removed_Packages reads Postfix Forwarder - no package maintainer, not converted, removed from the list of packages. Finally when we again have these packages that both help us and solve problems. Thank you very much.
-
Postfix Forwarder - no package maintainer, not converted, removed from the list of packages.
Not true. I've sent the pull request but it's still not verified or something on this direction.
-
So, what's the reason a 'ready to go' pull request for postfix isn't moving ahead? Did someone in high places just forget? Perhaps a friendly ping email to correct the impression of no maintainer??
-
Well, maybe the team was just trying to get 2.3.1 out the door and didn't have the time to look at packages?
-
Hey Marcello - I'm still steamed that pfSense didn't make it more obvious that the upgrade to 2.3 was going to destroy my Postfix installation. >:( I would NEVER have upgraded to 2.3 if I had known that all the work I did to get mail under control was about to be wiped out! I was so grateful to you for providing the port for pfSense; it worked flawlessly once I figured out how to configure it (that took a long time). Now my mail system is flooded with crap again every day. I cannot wait for Postfix to make it back into the 2.3.1 package installer.
Is there any way to download it directly from you/Github and install it manually into pfSense 2.3.1? I'm desperate to get my mail back under control.
Thanks for all your hard work!!
Rob…
-
…pfSense didn't make it more obvious that the upgrade to 2.3 was going to destroy my Postfix installation
You mean more than this?
Packages
The list of available packages in pfSense 2.3.x has been significantly trimmed. We have removed packages that have been deprecated upstream, no longer have an active maintainer, or were never stable. A few have yet to be converted for Bootstrap and may return if converted. See the 2.3 Removed Packages list for details.
But I understand your frustration.
-
Postfix Forwarder - no package maintainer, not converted, removed from the list of packages.
Not true. I've sent the pull request but it's still not verified or something on this direction.
No será cierto, pero es lo que informa la web de pfsense https://doc.pfsense.org/index.php/2.3_Removed_Packages
en estos momentos en que escribo este post dice así Postfix Forwarder - not converted (pending pull request) .
Muchas gracias a la espera de que salga pronto, hay alguna opción para poder instarlo manualmente.It will not be true, but what informs the web of pfsense https://doc.pfsense.org/index.php/2.3_Removed_Packages
right now as I write this post so says Postfix Forwarder - not converted (pending pull request).
Thank you very much waiting to come out soon, there is an option to manually urge. -
45 pages, sorry but i'm not going to wade through that.
Does this do smtp "passthrough" to the internal mail server for when you want to send mail?
I installed postfix on our debian server, and i can get incoming mail from outside mail servers go through postfix/spamassassin, and then to our internal server.
But the problem comes when you want to send mail from a client, when it connects it cannot do authentication (and ldap is insecure, i don't like it), and it says "relay access denied" - which makes sense due to it not being an open relay.
Can this do some kind of passthrough for when doing authentication to go directly to our internal one? -
passthrough is a nat/port forward. postfix is a postfix server. mainly to filter spam and that. =)
"relay access denied" is a wrongly configured postfix. check http://www.postfix.org/documentation.html .
-
passthrough is a nat/port forward. postfix is a postfix server. mainly to filter spam and that. =)
"relay access denied" is a wrongly configured postfix. check http://www.postfix.org/documentation.html .
yes i know, but doing port forward would make both incoming from client and server go to the internal server, that's not what i want
i only want postfix to handle incoming mail from servers outside the networkdocumentation doesn't help either because i don't know what to look for
-
you should have something like:
(internet)<–----->pfsense<------>intranet
---(postfix)so basically you came into the thread without reading the whole 45 pages with a problem. and you dont want to read the documentation because you dont know what to look for.
why dont you start by expaining nicely:
-what you want to do,
-which environment you have,
-which pf config/version, etc.
and what tests you have made. like telneting x port from the 'inside' and telneting the port from the 'outside' with a nice pastebin link so we all can read about it. also quoting logs is a plus to know what to look for.right now, we are having a conversation on when postfix package will be available upstream.
bye, -
mrbrax: To use postfix for incoming filtering+ store and forward, without using it for lan->wan email, simply configure all users to point their email systems send configuration to some random free port number on the WAN interface-l which you nat to your internal systems. Allow postfix on pfsense to operate normally, d-natting (port forwarding) 25 and maybe 465 to postfix on pfsense.
Also, kindly consider those offering their time to help you here are volunteers, many of whom have taken the time to understand the tools in order to be of service. PFsense has this package as a frontend on postfix as you know. You will pay yourself 10 minutes for every one you spend reading the postfix documentation, even though it doesn't seem like it when you're doing the reading. I hope once you also find success you'll return the favor to help others here.
-
you should have something like:
(internet)<–----->pfsense<------>intranet
---(postfix)so basically you came into the thread without reading the whole 45 pages with a problem. and you dont want to read the documentation because you dont know what to look for.
why dont you start by expaining nicely:
-what you want to do,
-which environment you have,
-which pf config/version, etc.
and what tests you have made. like telneting x port from the 'inside' and telneting the port from the 'outside' with a nice pastebin link so we all can read about it. also quoting logs is a plus to know what to look for.right now, we are having a conversation on when postfix package will be available upstream.
bye,forget it, this sounds too complicated anyway. we'll just continue dealing with putting spam manually in the bin
mrbrax: To use postfix for incoming filtering+ store and forward, without using it for lan->wan email, simply configure all users to point their email systems send configuration to some random free port number on the WAN interface-l which you nat to your internal systems. Allow postfix on pfsense to operate normally, d-natting (port forwarding) 25 and maybe 465 to postfix on pfsense.
Also, kindly consider those offering their time to help you here are volunteers, many of whom have taken the time to understand the tools in order to be of service. PFsense has this package as a frontend on postfix as you know. You will pay yourself 10 minutes for every one you spend reading the postfix documentation, even though it doesn't seem like it when you're doing the reading. I hope once you also find success you'll return the favor to help others here.
As said, i don't know what to look for - for the stuff i want to do, so reading the documentation is useless when i barely know what i want to do in the first place.
and changing the configuration for everyone? not happening. if it doesn't work on port 25/587 on one domain it's not worth looking into.What do you mean? consider volunteers?
