Hello.
I installed OPNsense 25.7.6 and Postfix 1.24 on it.
The problem is that I'd like to block by sender IP address or domain.
Postfix only has Senders, which works if you specify a specific email address (*@xxx.ru doesn't work).
I understand you can block through a firewall, but I'd like to use Postfix specifically.
Has anyone encountered this?
What did you install for content filtering? Rspamd or other?
Quote from: Giz on October 29, 2025, 12:46:43 PMWhat did you install for content filtering? Rspamd or other?
Iinstalled, but not configured
then use whatever GUI you setup for and add a regex for header eg: /<.+?@.+?\.ru>/
i have an email server behind opnsense, i do all the ip blocking on opn and i do all the regex stuff on the email server. greatly reducing the work load on email server
For example, what do you write in Senders to block IP 1.2.3.4 and if with a mask 1.2.3.4/19?
Previously, I used pfsense, and it was easier to set up restrictions there, but I can't do it in opnsense (I only managed to set it up for the sender's domain).
Quote from: ddd149 on October 29, 2025, 03:39:45 PMFor example, what do you write in Senders to block IP 1.2.3.4 and if with a mask 1.2.3.4/19?
Create your own Firewall Alias eg: Name: My_Blocks_Network, Type: Network, Content: 1.2.3.4/19 and save that
Create Firewall Rule eg: Action: Block, Interface: WAN, Source: My_Blocks_Network, Log: Check it, Give Description for label in live view, save it
Move rule up to where you need it (usually before any pass) and apply it
Postfix now won't even see any packets from that network
I understand how to do it with Firewall, but how do I block addresses using Postfix itself, or does it not work in OPNsense?
What are you blocking with the header regex then?
Quote from: ddd149 on October 29, 2025, 04:06:49 PMI understand how to do it with Firewall, but how do I block addresses using Postfix itself, or does it not work in OPNsense?
What are you blocking with the header regex then?
Like I said earlier, I do ALL ip address blocking on the OPNSense side (Spamhaus type lists), and do ALL the Content (Header/Body) with regex in my GUI frontend for email system. Keeps it cleaner and when reviewing mail.log I can grab an ip if need be and add to OPNSence to block it for good.
Quote from: Giz on October 29, 2025, 04:17:16 PMQuote from: ddd149 on October 29, 2025, 04:06:49 PMI understand how to do it with Firewall, but how do I block addresses using Postfix itself, or does it not work in OPNsense?
What are you blocking with the header regex then?
Like I said earlier, I do ALL ip address blocking on the OPNSense side (Spamhaus type lists), and do ALL the Content (Header/Body) with regex in my GUI frontend for email system. Keeps it cleaner and when reviewing mail.log I can grab an ip if need be and add to OPNSence to block it for good.
Sorry, I'll ask again. Am I correct in understanding that you block IP addresses at the firewall level, not in Postfix?
Do you also use spam lists at the firewall level?
Quote from: ddd149 on October 29, 2025, 04:23:21 PMQuote from: Giz on October 29, 2025, 04:17:16 PMQuote from: ddd149 on October 29, 2025, 04:06:49 PMI understand how to do it with Firewall, but how do I block addresses using Postfix itself, or does it not work in OPNsense?
What are you blocking with the header regex then?
Like I said earlier, I do ALL ip address blocking on the OPNSense side (Spamhaus type lists), and do ALL the Content (Header/Body) with regex in my GUI frontend for email system. Keeps it cleaner and when reviewing mail.log I can grab an ip if need be and add to OPNSence to block it for good.
Sorry, I'll ask again. Am I correct in understanding that you block IP addresses at the firewall level, not in Postfix?
Do you also use spam lists at the firewall level?
yes and yes, that way if spam gets thru, the mail.log results will give me info i need on if i block at fw or regex it on mail server