Email server behind pfSense



  • Dear all,

    I am very new at pfSense. We used Fortigate 100A previously. Now we have configured a pfSense. But we couldn’t able to configure our email server appropriately.  As a result I need your help.
    The configuration info are given below:

    Internal Email Server IP: 10.10.1.5
    Email Server IP: 94.55.x.x
    pfSense External IP: 94.54.x.x

    Thanks in advance for the assistance.



  • You need to provide a little more info…    🙂

    Do you have more than 1 WAN IP?

    Are you using the WAN IP for only this server?

    And you might include the other server I just noticed in your other post. Since this is the same subject, can you please keep it all in one place??  Thanks!  😉



  • This is the Network you can find in the attachment.



  • Rebel Alliance

    You still haven’t answered the question… You say your WAN IP is 94.54, but then your email is 94.55

    So you own 2 class B?  Has your ISP routed multiple segments to you?  They gave you disjointed multiple IPs?

    Or is that just a typo??



  • If you have valid ips on pfsense as well on servers, you do not need nat, just need firewall rules.

    If your email server runs windows, I suggest you to take a look at postfix forwarder package to protect you mail system.



  • Thanks marcelloc,

    I will try to use postfix forwarder package. What can I use as anti-spam with postfix?

    I tried with Firewall rules for the ports IMAP, POP3 and SMTP individually defining them but when mails sent from the it shows that the mail server ip was not 94.55.x.x instead it took the firewall ip as 94.54.x.x. How can I solve the problem.

    If I create the virtual ip with the External email server ip 94.55.x.x and then make individually port forwarding for IMAP, POP3 and SMTP will it work? what do you think?

    Thanks for your advice.



  • johnpoz,

    The ISP provided a 16 block of IP for using our servers from same block and gave 1 ip from another block for our firewall. This situation was predefined.



  • @nahid:

    I will try to use postfix forwarder package. What can I use as anti-spam with postfix?

    postfix package has a lot of antispam features but you can install mailscanner package too.

    @nahid:

    I tried with Firewall rules for the ports IMAP, POP3 and SMTP individually defining them but when mails sent from the it shows that the mail server ip was not 94.55.x.x instead it took the firewall ip as 94.54.x.x. How can I solve the problem.

    to use firewall ip as mx, you will need nat or postfix forwarder package



  • “to use firewall ip as mx, you will need nat or postfix forwarder package”

    I need mail server ip (94.55.x.x) as mx. In this case is it possible to configure it from postfix package?



  • @nahid:

    “to use firewall ip as mx, you will need nat or postfix forwarder package”

    I need mail server ip (94.55.x.x) as mx. In this case is it possible to configure it from postfix package?

    postfix will use server address, if you have 94.55. IP on pfsense, it will work



  • Dear marcelloc,

    Don’t mind. Actually I am very new in pfSense. What do you mean by 94.55.x.x ip in pfSense? My WAN IP is 94.54.x.x and my internal mail server configured as 10.10.1.5. Domain MX record is on 94.55.x.x and I want to send and receive mail through 94.55.x.x

    I checked the postfix forwarder option that takes the Domain name and ip. If I put the domain name and ip (94.55.x.x) there will it work?

    Thanks for your help.



  • nahid,

    You network diagram shows internal and external ips on your mail server. If this ip is an alias on your pfsense, you just need to configure this alias to postfix forwarder and make an outbound nat (firewall -> nat) to force exchange outgoing ip address to be the same as mx.

    att,
    Marcello Coutinho



  • Thanks Marcello Coutinho.

    I will do exactly what you have told on Saturday.



  • Marcello,

    How can I configure an aliases in postfix forwarder? Is it the domain where I can give the aliases ip address or something else?



  • @nahid:

    Marcello,

    How can I configure an aliases in postfix forwarder? Is it the domain where I can give the aliases ip address or something else?

    on domain tab you specify internal domains as well internal ips.

    do you mean domain aliases like mydomain.com and domain2.com?



  • Dear marcelloc,

    I tried how you told to configure it but could able to send email as it marked the wan IP address as spam. I inspected the email headers and it showed that the email was sent from ip address 94.54.x.x what is not my email server ip.

    I configured the outbound nat but it failed to send over Email Server IP



  • Using you internal mail server only and having you mx IP as an alias on your pfsense, an outbound nay should work.  Remember to configure outbound Nat mode to manual.



  • Dear Marcelloc,

    Attached picture where you can find my config. Is there any mistakes there?






  • Change interface to wan and place rule on top



  • Dear marcelloc,

    I tried how you instructed but unsuccessful. Is there any way to solve this problem?



  • Do you send email to the internal email server and then use the external as a forwarder, and then use the external as the public email mx and forward all inbound emails to the internal server?

    As marcelloc indicated, NAT rules work on first matching. So if the desired effect is below an undesired action, then you will need to move it to the top.



  • Podilarius,

    “Do you send email to the internal email server and then use the external as a forwarder, and then use the external as the public email mx and forward all inbound emails to the internal server?”

    how can I do that?



  • Nahid,
    That is going to depend on the type of email servers you are using. I use 2 email server types; Exchange and Zimbra. The setup for something like this is different in each, but it is possible. I asked to try to figure out what you are trying to accomplish. Are you in control of the 94.55 address where the external mail server is?



  • We use MerakMail (IceWarp) mail server. My email Server is installed in a local machine with IP 10.10.1.5. The ISP provider has given us some static IP those we use for our servers. For example 94.55.59.129 is for our webserver but webserver is in our local ip with 10.10.1.11. I natted the 80 port with 94.55.59.129 and it is working with no problem. The same thing I want do is to send from and get mails from 10.10.1.5 but it should use 94.55.59.130 as permitted sender.

    I have also natted the IMAP, POP3, and SMTP port forwarding. Could you please describe me the configuration that I need to send mail from 10.10.1.5 behind the pfSense but using the MX record of 94.55.59.130.

    If you need further information please let me know.



  • Ah … okay I see. Looking at the advanced outbound rule you posted, it seems wrong. As the others stated, you need to put this rule above all others in the AON screen. You also need to change the destination port to blank (any). Your server is going to be responding to request on high port with a source port of 25. As others have stated, you also need to change the interface to WAN.
    I would open it up first and then lock it down so i would do:

    Interface: WAN
    Source: INTERNALMAILSERVER
    SPort: any
    Destination: any
    DPort: any
    NAT Address: SESRICMailServer
    NAT Port: blank (any)

    If that works, then just change SPort to 25 if you only want to NAT smtp.



  • You can get the configuration picture attached.








  • Will the above configuration work or is there anything wrong?



  • The configuration from the pics looks good. If it is not working, try restarting the FW.



  • Nahid,

    You have two nats for the same port 80. It will not work.

    The rest of your config is fine but you may need to test with bogons rules disabled on wan interface.



  • @marcelloc:

    Nahid,

    You have two nats for the same port 80. It will not work.

    The rest of your config is fine but you may need to test with bogons rules disabled on wan interface.

    They are to 2 different servers and 2 hopefully different internal ips (different aliases), so it should be okay.



  • @podilarius:

    They are to 2 different servers and 2 hopefully different internal ips (different aliases), so it should be okay.

    That’s right podilarius, if web server and mailserver are different wan ip’s the nat is fine.

    nahid,

    Did you changed you pfsense gui port as well disabled webConfigurator redirect rule  on system-> advanced?



  • marcelloc,

    I have done that what you have said. And as podilarius said I have 2 different IP both internally and externally for the respective servers.
    I am going to test now whether the above mentioned configuration is working or not.



  • nahid-

    I assume you have set up a VIP for each of your public IP address you intend to use…??



  • chpalmer,

    What I have to do? I have to create Virtual IP for my Email Server or Aliases is ok?

    Could you please explain.



  • marcelloc,

    _"
    nahid,

    Did you changed you pfsense gui port as well disabled webConfigurator redirect rule  on system-> advanced?"_

    I haven’t changed it? Do I have to change it? or it ok?



  • @nahid:

    I haven’t changed it? Do I have to change it? or it ok?

    yes, config these steps to avoid problems on port 80 nat.



  • @marcelloc:

    @nahid:

    I haven’t changed it? Do I have to change it? or it ok?

    yes, config these steps to avoid problems on port 80 nat.

    Marcello-    he needs a VIP for that external IP doesn’t he??



  • @chpalmer:

    Marcello-    he needs a VIP for that external IP doesn’t he??

    The aliases on screen shots suggest that vip/ip alias are configured.



  • Marcello,

    I am still not sure that what I have to use. Virtual IP or Aliases for my External Mail server forwarding or both of them are ok?



  • With one firewall, use IP alias. Firewall -> virtual ip-> IP alias


Locked
 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy