pfSense Gold Subscription

Author Topic: email server behind pfSense  (Read 8825 times)

0 Members and 1 Guest are viewing this topic.

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #15 on: April 21, 2012, 08:32:37 am »
Dear marcelloc,

I tried how you told to configure it but could able to send email as it marked the wan IP address as spam. I inspected the email headers and it showed that the email was sent from ip address 94.54.x.x what is not my email server ip.

I configured the outbound nat but it failed to send over Email Server IP

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 10006
  • Karma: +6/-0
    • View Profile
Re: email server behind pfSense
« Reply #16 on: April 21, 2012, 01:03:09 pm »
Using you internal mail server only and having you mx IP as an alias on your pfsense, an outbound nay should work.  Remember to configure outbound Nat mode to manual.

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #17 on: April 21, 2012, 03:26:01 pm »
Dear Marcelloc,

Attached picture where you can find my config. Is there any mistakes there?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 10006
  • Karma: +6/-0
    • View Profile
Re: email server behind pfSense
« Reply #18 on: April 21, 2012, 03:51:55 pm »
Change interface to wan and place rule on top

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #19 on: April 24, 2012, 05:20:41 pm »
Dear marcelloc,

I tried how you instructed but unsuccessful. Is there any way to solve this problem?

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #20 on: April 25, 2012, 12:46:38 am »
Do you send email to the internal email server and then use the external as a forwarder, and then use the external as the public email mx and forward all inbound emails to the internal server?

As marcelloc indicated, NAT rules work on first matching. So if the desired effect is below an undesired action, then you will need to move it to the top.

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #21 on: April 25, 2012, 01:37:14 am »
Podilarius,

"Do you send email to the internal email server and then use the external as a forwarder, and then use the external as the public email mx and forward all inbound emails to the internal server?"

how can I do that?

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #22 on: April 25, 2012, 05:37:06 am »
Nahid,
That is going to depend on the type of email servers you are using. I use 2 email server types; Exchange and Zimbra. The setup for something like this is different in each, but it is possible. I asked to try to figure out what you are trying to accomplish. Are you in control of the 94.55 address where the external mail server is?

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #23 on: April 25, 2012, 06:19:05 am »

We use MerakMail (IceWarp) mail server. My email Server is installed in a local machine with IP 10.10.1.5. The ISP provider has given us some static IP those we use for our servers. For example 94.55.59.129 is for our webserver but webserver is in our local ip with 10.10.1.11. I natted the 80 port with 94.55.59.129 and it is working with no problem. The same thing I want do is to send from and get mails from 10.10.1.5 but it should use 94.55.59.130 as permitted sender.

I have also natted the IMAP, POP3, and SMTP port forwarding. Could you please describe me the configuration that I need to send mail from 10.10.1.5 behind the pfSense but using the MX record of 94.55.59.130.

If you need further information please let me know.

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #24 on: April 25, 2012, 06:35:54 am »
Ah .. okay I see. Looking at the advanced outbound rule you posted, it seems wrong. As the others stated, you need to put this rule above all others in the AON screen. You also need to change the destination port to blank (any). Your server is going to be responding to request on high port with a source port of 25. As others have stated, you also need to change the interface to WAN.
I would open it up first and then lock it down so i would do:

Interface: WAN
Source: INTERNALMAILSERVER
SPort: any
Destination: any
DPort: any
NAT Address: SESRICMailServer
NAT Port: blank (any)

If that works, then just change SPort to 25 if you only want to NAT smtp.

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #25 on: April 25, 2012, 06:57:31 am »
You can get the configuration picture attached.
« Last Edit: April 25, 2012, 07:00:22 am by nahid »

Offline nahid

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #26 on: April 25, 2012, 07:02:30 am »
Will the above configuration work or is there anything wrong?

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #27 on: April 25, 2012, 07:23:28 am »
The configuration from the pics looks good. If it is not working, try restarting the FW.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 10006
  • Karma: +6/-0
    • View Profile
Re: email server behind pfSense
« Reply #28 on: April 25, 2012, 07:40:47 am »
Nahid,

You have two nats for the same port 80. It will not work.

The rest of your config is fine but you may need to test with bogons rules disabled on wan interface.

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: email server behind pfSense
« Reply #29 on: April 25, 2012, 09:36:19 am »
Nahid,

You have two nats for the same port 80. It will not work.

The rest of your config is fine but you may need to test with bogons rules disabled on wan interface.

They are to 2 different servers and 2 hopefully different internal ips (different aliases), so it should be okay.