Topics

I have an opnsense firewall (business edition) which utilizes plugins for postfix and rspamd. We sometimes receive spam mails, originating from different mail servers (sending SMTP), which are however from the same second level domain.

Example:
Spam sending SMTP server 1 has fqdn and also PTR entry: xyz.spamfreak.com
Spam sending SMTP server 2 has fqdn and also PTR entry: abc.asd.spamfreak.com

Is there a way to use a wildcard approach to block all and any communication with hosts having a PTR entry in DNS, that matches spamfreak.com at the end?
So it should block *.spamfreak.com but also *.*.spamfreak.com.

Hello there

It seems that HAproxy does not at all react to whatever changes i make.
I want to put a single backend host into maintenance mode or through what ever means is achievable, that this host is no longer accessible from the outside, so I can run maintenance tasks.

If I set that host into maintenance mode, the website it hosts is still accessible from WAN. If I change the IP address of the backend server to another non existant address, that freakin web page is still loading from WAN.
It doesn't matter what I do, even restart HA proxy, I am totally unable to restrict that access.
HAproxy seems badly broken to me...
Anybody else?

Cheers

Hello there

I'm using OPNsense with the Postfix plugin as a mail gateway.
We have a secure mail provider here in Switzerland called IncaMail.
They require us to have our MTA provide a client certificate to their receiving MTA when we send mails to them.
You can easily check it by sending a mail to mta@check.incamail.ch, which sends back its findings about receiving and sending capabilities of your own MTA, the OPNsense in that case, of course.

The first part of the answer, which is sending from the OPNsense to the MTA of check.incamail.ch, tells me that there is no client certificate.

The second part is the other way around, where MTA from check.incamail.ch is sending a mail to the OPNsense, which works as it should.

How can I provide a client certificate to the MTA of check.incamail.ch?

I've read, that enabling "smtpd_tls_ask_ccert = yes" should not be used in general, as it could break legitimate mail transfer with sendmail MTAs.

Would there be a solution around "smtp_tls_policy_maps"?
If yes, how should that policy map look like and how can I tell OPNsense to use it, as it probably is a bad idea to directly modify postfix main.cf

Thanks for any hint :)

Hello there

I have following task at hand:
An internal mail sending machine (LAN zone) has a non changeable email sender address in this form: machine@otheraddress.com
That machine however needs to send mails to external address with this from address: machine@address.com

In order to achieve that I thought that "Sender Canonical Rewriting is the necessary feature and configured this:

Rewrite From:   /machine@otheraddress.com/i
Rewrite To:   machine@address.com

My expectation would be, that any outbound mail sending (from LAN to WAN) with a sender address of "machine@otheraddress.com" should now get rewritten to "machine@address.com".
Well, it's not working...

What am I doing wrong?

Thanks for a hint  ;)

Best
Juri

Hi all

Since OPNsense and it's postifx plugin act as a mail gateway and not as a final destination, it should not allow for backscatter mail.

That is; it should not accept inbound mails for recipients which do not exist on the final destination mail server.

Postfix does have a setting for that:

smtpd_recipient_restrictions =
       reject_unverified_recipient

That setting tells the OPNsense postfix to not yet accept that inbound mail, but first check with the internal destination mail server if that recipient would be accepted. If yes, it will happily accept that inbound mail (when it passed all other tests ofc). If not, it will send a 5xx response and therefore actively not contributing to backscatter.

Is there a way to add that setting to the main.cf or does that require a plugin update?

There is an option in the GUI called "Enforce Recipient Relay Check", which sounds similar, but requires you to feed the "Recipients" in the postfix plugin manually, which seems to me quite error prone.
Postfix can do this automatically, no need to feed an outer postifx with acceptable recipients.

It would help tremendously if one would be able to have a custom script block in order to proivde more options for the main.cf, like the one mentioned above. That way we could also easily add custom block lists and more, if necessary.

Any input is welcome. :)

Hi all

My setup:
OPNsense 20.7.1 running as Hyper-V vm
Installed plug ins:
- acme-client v1.35
- c-icap v1.7
- clam-av v1.7
- haproxy v2.23
- postfix v1.15
- redis v1.1
- rspamd v1.9

Postfix is configured as MX for several domains.

Postifx logs the following warning when selected smtp servers connect:
warning: permit_tls_clientcerts is requested, but "smtpd_tls_ask_ccert = no"

The warning does therefore not come up with all smtp inbound connections, but with some.

Is this something I should worry?

Cheers
Juri