Postfix - antispam and relay package

mrbrax

Just set up your internal mail servers to not use postfix as an outgoing relay.

no, that's not the problem, the problem comes when a client wants to send mail, not a server. i. just. want. it. to. redirect. the. authentication. to. the. internal. server. and. have. it. handle. the. sending.

hcoin

Good luck to you.

WMeert

@mrbrax:

@hcoin:

Just set up your internal mail servers to not use postfix as an outgoing relay.

no, that's not the problem, the problem comes when a client wants to send mail, not a server. i. just. want. it. to. redirect. the. authentication. to. the. internal. server. and. have. it. handle. the. sending.

Mrbrax is right I think: A client sending a mail does not have to pass postfix on the pfsense box at all. And we have the same set-up for our mobile clients.

As the client needs to authenticate, you want to use secure SMTP, so the client will not send/connect to the standard SMTP port 25 of mail.ourdomain.com (which is captured by the postfix on the pfsense box), but instead use port 465 or 587 (SMTP submission). So a simple NAT rule to port forward 465 and 587 to the internal mail server does the job.

So you get:
incoming port 25 (SMTP traffix from other servers): forward/NAT to the postfix on the pfsense box;
incoming port 465/587 (SMTP traffix from clients): forward/NAT to internal mail server.

mrbrax

@WMeert:

@mrbrax:

@hcoin:

Just set up your internal mail servers to not use postfix as an outgoing relay.

no, that's not the problem, the problem comes when a client wants to send mail, not a server. i. just. want. it. to. redirect. the. authentication. to. the. internal. server. and. have. it. handle. the. sending.

Mrbrax is right I think: A client sending a mail does not have to pass postfix on the pfsense box at all. And we have the same set-up for our mobile clients.

As the client needs to authenticate, you want to use secure SMTP, so the client will not send/connect to the standard SMTP port 25 of mail.ourdomain.com (which is captured by the postfix on the pfsense box), but instead use port 465 or 587 (SMTP submission). So a simple NAT rule to port forward 465 and 587 to the internal mail server does the job.

So you get:
incoming port 25 (SMTP traffix from other servers): forward/NAT to the postfix on the pfsense box;
incoming port 465/587 (SMTP traffix from clients): forward/NAT to internal mail server.

THANK YOU.

But doesn't some servers send mail to 587? Or is that only for clients?
Because when before 587 didn't exist that had to be the case

azekiel

Guys. Postfix is for sending mails from server to server. This has nothing to do with your client set up. Period.
If you want clients to send mails via MAPI, OWA, Anywhere, ActiveSync, SMTP, SMTPS, PHP Module or whatever you like, you need to set up your mailserver correctly.

So, for SMTPS, it would be a port forward port 587&465 to your internal mailserver.

But, again, this has nothing to do with postfix. Don't mix up topics.

If you have no clue how these services need to be seperated don't set up a postfix yourself.

mrbrax

@azekiel:

Guys. Postfix is for sending mails from server to server. This has nothing to do with your client set up. Period.
If you want clients to send mails via MAPI, OWA, Anywhere, ActiveSync, SMTP, SMTPS, PHP Module or whatever you like, you need to set up your mailserver correctly.

So, for SMTPS, it would be a port forward port 587&465 to your internal mailserver.

But, again, this has nothing to do with postfix. Don't mix up topics.

If you have no clue how these services need to be seperated don't set up a postfix yourself.

Exactly, so that's why i want to forward client mail sending to the internal one instead.
Just wanted to make sure servers don't use 587

kalessin

I dont understand folks that get into a thread to complain about how bad 'x' product is, and at the end its their own lack of knowledge regarding systems/protocols/ and how things work that makes them fail.
from the begining several users asked about hows mbrax config, right? I remember asking for details etc, and got his denial on share info, so why are we answering this guy? isnt it MUCH MORE SIMPLIER to answer a TECHNICAL question with the background+environment information? I mean… we dont even know which pf version this guy is running....

swimming in the dark here...

mrbrax

@kalessin:

I dont understand folks that get into a thread to complain about how bad 'x' product is, and at the end its their own lack of knowledge regarding systems/protocols/ and how things work that makes them fail.
from the begining several users asked about hows mbrax config, right? I remember asking for details etc, and got his denial on share info, so why are we answering this guy? isnt it MUCH MORE SIMPLIER to answer a TECHNICAL question with the background+environment information? I mean… we dont even know which pf version this guy is running....

swimming in the dark here...

haha sorry, i'm not very used to asking questions as i can usually find information myself
if anyone still wants info for some reason, it's pfsense 2.2.6-release, no postfix package installed on it (now that i heard about the port forwarding thing i'll use one of our servers), and i still don't know what more info to give :P

i do have issues in general understanding and communicating to people, but at least you guys haven't given up as with many other sites - so that i am grateful for
i'd totally pay for pfsense gold but we use it at work and i'm not in charge of finance/buying stuff

mrbrax

Well i can't get it to work anyway, it times out when i change the 25 port forward to the postfix server, but i can telnet it no problem.

Thanks for the help still. Not really pfSense related anymore.

edit

yep it's not possible to have a postfix relay server behind pfsense, it times out. been trying for 6 hours. should i file a bug report maybe?

edit

finally managed to get it to work, let's put this to rest. internal postfix server nic did not have a valid gateway, ~15 hours of searching/trying got me "sudo route add -net default gw 192.168.1.1 dev eth1" and it just started working
some config alterations after that and we now have a working spam filter - no thanks to exchange!

thanks to everyone that tried to help however, much appreciated!

MadCatZA

FYI. If you are in a bind and need a postfix solution, look into Nethserver.

mrbrax

@MadCatZA:

FYI. If you are in a bind and need a postfix solution, look into Nethserver.

No hardware left over, and we already have a machine in its place with Debian.

It didn't work out though, seems like it can only have one gateway at a time unlike Windows, so it's either spam filter or our website.
Seems like we're gonna have to endure the spam still.

LinuxCuba

Se olvidaron del postfix y mailscanner por fin ya va el pfsense 2.3.2 y nada de estos paquetes. Salu2

deddric

Is this coming o 2.3.2 ?

netsense

Are there any news about pfsense 2.3 and postfix forwarder?

biggsy

Yes, here.

Bismarck

Postfix + MailScanner runs fine here, it just needs manual installation and even survived pfSense update from 2.3.2 –> 2.3.2-p1. :P

eaykoc

@Bismarck:

Postfix + MailScanner runs fine here, it just needs manual installation and even survived pfSense update from 2.3.2 –> 2.3.2-p1. :P

Would you please tell us how you installed them to pfSense 2.3.2?

The whole week I've been trying to compile and install the necessary (afaik) packages and I've failed in every possible way.

Bismarck

scroll down to Reply #709
/edit

the View config / Search mail / Queue / About / tabs are broken, everything else works great.

Ralph-DE

@Bismarck:

next get those postfix files from github for 2.3.

https://github.com/pfsense/FreeBSD-ports/pull/23/files

and copy them where they are belong

Can anybody tell how to do this? Get how and copy where?

Bismarck

MAKE A BACKUP BEFORE YOU GO THIS ROUTE!

Those are the files needed, for the manual install of the Postfix Package for pfSense 2.3.x

**/usr/local/bin/adexport.pl

/usr/local/www/shortcuts/pkg_postfix.inc

/usr/local/www/postfix_view_config.php
/usr/local/www/postfix_about.php
/usr/local/www/widgets/widgets/postfix.widget.php
/usr/local/www/postfix_queue.php
/usr/local/www/postfix_search.php
/usr/local/www/postfix_recipients.php
/usr/local/www/postfix.php

/usr/local/pkg/postfix_domains.xml
/usr/local/pkg/postfix_antispam.xml
/usr/local/pkg/postfix.inc
/usr/local/pkg/postfix_recipients.xml
/usr/local/pkg/postfix.xml
/usr/local/pkg/postfix_sync.xml
/usr/local/pkg/postfix_acl.xml

/usr/local/etc/rc.d/postfix
/usr/local/etc/rc.d/postfix.sh

/etc/inc/priv/postfix.priv.inc

/etc/inc/system.inc**

Download the attached pfSense-2.3-Postfix.zip, unzip and copy the files to your system root /.
Unlock the FreeBSD repo in

/usr/local/etc/pkg/repos/FreeBSD.conf > enabled: yes

/usr/local/etc/pkg/repos/pfSense.conf > enabled: yes

Install Postfix via pkg

pkg install postfix

Next edit:

/conf/config.xml

and add Postfix to the Service Status and Menu:

<service><name>postfix</name>
<rcfile>postfix.sh</rcfile>
<executable>master</executable></service>

**<menu>
<name>Postfix Forwarder</name>
<tooltiptext>Configure Postfix Forwarder</tooltiptext>
Services
<url>/pkg_edit.php?xml=postfix.xml&id=0</url>
</menu>

<menu>
<name>Search Mail</name>
<tooltiptext>Search postfix logs</tooltiptext>
Diagnostics
<url>/postfix_search.php</url>
</menu>

<menu>
<name>Postfix Queue</name>
<tooltiptext>check postfix queue</tooltiptext>
Status
<url>/postfix_queue.php</url>
</menu>**

Now cross your fingers and reboot! :P

pfSense-2.3-Postfix.zip