This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Setup Mail Security inbound outbound scanning

I've searched the forums fairly extensively but can't seem to find a solution that matches the concern that i have so I'm going to post it here and see if I can get some help.

If you do respond please feel free to explain like I'm a 4 year old who needs explicit directions.

Astaro Security Gateway 8.003

I have a single mail server that sits behind the firewall and is connected to via external IMAP users as well as being the primary mail server that sends email.

Firewall
WAN:  ***.***.***.100
LAN:  10.0.0.1

Mail Server (mail-01)
WAN:  ***.***.***.105
LAN:  10.0.0.5   [Definitions->Networks->Host]

Mail Security --> Routing
* Domains (example.com) - added
* Route by: Static Host List
* Host List (mail-01)
* With Callout

Mail Security --> AntiVirus
* AntiVirus check footer CHECKED

Mail Security --> AntiSpam
* Reject at SMTP Time:  Confirmed Spam
* Advanced anti-spam features:  ALL CHECKED

Mail Security --> Exceptions
* NONE

Mail Security --> Relaying
* Allow Authenticated Relaying - CHECKED
* Allowed users/groups (email security group - custom created)
* Allowed hosts/networks (Internal (network))
* Scan relaying (outgoing) messages - CHECKED

Mail Secuirty --> Advanced
* NONE (other than default Advanced settings)

DNAT/SNAT - NETWORK SECURITY

Inbound Mail DNAT
Any --> Email Messaging (IMAP,POP3,SMTP + all SSL versions) --> Ext WAN .105 --> mail-01

Outbound Mail SNAT
mail-01 --> SMTP --> Any -->Ext WAN .105

RESULTS OF ABOVE CONFIGURATION

I can send and receive email correctly.
The mail server is configured to ensure it is not an open relay.
The email header when delivered shows the correct HELO from the mail server.

The issue is that it appears that neither inbound or outbound emails are being scanned by the Astaro firewall.

This makes sense in regards to the outgoing email as am I'm not relaying through the Astaro.  I would have thought however that the antiVirus and antiSpam features of the Astaro gateway would still be in effect on inbound email.

I am getting a TON of spam emails in my inbox with this current configuration and the mail manager shows that there are NO stored or quarantined messages which makes me believe that Astaro is not scanning those messages.

OPTION TWO

Mail Security --> Advanced
* Use Transparent Mode - CHECKED

This change appears to intercept inbound and outbound SMTP traffic (as indicated in info), which on the surface seems to be the solution.

This change however means that all outbound email now goes out on WAN ***.***.***.100 instead of ***.***.***.105 as before.  In order to solve this I add the SNAT rule;

Ext WAN .100 --> SMTP --> Any -->Ext WAN .105

This forces SMTP traffic on the firewall to use the Ext mail IP that I have all my RDNS setup on.

While this solution would work if I only ever have a single mail server behind the firewall, as soon as I would add a second internal mail server  I would have the problem of trying to redirect SMTP traffic on Ext WAN .100 to more than one Ext WAN IP address which I don't think Astaro can do.

DESIRED SOLUTION

I want to have a mail server (or multiple mail servers should I need) behind the firewall that can send outbound email which can be scanned by Astaro prior to being sent.  I also want all incoming SMTP mail to that mail server to be scanned by Astaro for virus and spam before it reaches my mail server.

It does not matter if all SMTP authentication is done by the mail server itself (as present configuration does), or if I need to utilize Authenticated relay with allowed users/groups as would be required with Transparent Mode.

My current configuration works but seems to bypass Astaro which seems to defeat the benefits offered by Astaro.  I'm a little lost on what piece of this i'm missing, whether it's configuring Interfaces & Routing --> Static routing or whether Astaro really is scanning inbound and I'm just not seeing it.

At the very least I want Astaro to scan inbound email, outbound is a "nice to have" not a "need to have".

Any thoughts, suggestions and/or detailed ideas you have would be greatly appreciated.

Thanks

Ryan

This thread was automatically locked due to age.

Parents

0 BAlfson over 13 years ago

Hi, Ryan, and welcome to the User BB!
Mail Security --> Relaying
* Allow Authenticated Relaying - CHECKED
* Allowed users/groups (email security group - custom created)
* Allowed hosts/networks (Internal (network))
* Scan relaying (outgoing) messages - CHECKED

* Use Transparent Mode - CHECKED

There are several errors there.

While this solution would work if I only ever have a single mail server behind the firewall, as soon as I would add a second internal mail server I would have the problem of trying to redirect SMTP traffic on Ext WAN .100 to more than one Ext WAN IP address which I don't think Astaro can do.

That's what SMTP Profiles are for.

If you want everything to work as you desire, you should start with a configuration just as I recommended for Exchange: https://community.sophos.com/products/unified-threat-management/astaroorg/f/56/p/48998/178769#178769.

Cheers - Bob
PS Also, I suggest you read https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/p/27697/83561#83561.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 eomedia over 13 years ago in reply to BAlfson

Thanks for the replies.

I made one update based on dilandau's suggestion and removed the SMTP from the incoming DNAT rule.  This immediately solved the problem of inbound SMTP mail skipping the Astaro SMTP proxy - all inbound email is now being scanned by the gateway.  I knew i was missing something fairly simple and that was it, thank you!

This solution did however raise another issue in that we have people from outside the firewall that connect via IMAP to the mail server behind the firewall, and when they want to send an email from their remote location that email is sent as SMTP (port 25) and was now being caught by the firewall proxy instead of passing directly to the mail server.  They could still send email but when it reached the RCPT the header showed it as coming from the Astaro HELO instead of the mail server as would be the case for users sending from behind the firewall.

We solved this issue by having those remote users change their outgoing SMTP mail server port from 25 to 587 and adding a new DNAT rule on incoming port 587 to forward directly to the mail server and translating those requests back to port 25 - this way bypassing the Astaro gateway for those requests as they aren't truly inbound emails.

This solution solved our primary issues.

At present the outbound SMTP is not being scanned the the gateway because i am NOT using the Astaro relaying, which is okay for now as I need to review further how relaying outgoing through the gateway affects the DNAT rules we use now for ensuring email is delivered on the correct mail server WAN IP address (e.g. for RDNS issues, etc) instead of the default firewall IP.

If you have all mail going OUT on a single IP address, or multiple IP addresses for a single mail server it seems pretty straight forward, even with SMTP profiles to manage individual domains.  If however you have mail servers for more than one company going out on individual IP addresses it seems a little more tricky to ensure Company A's mailServerA goes out on IP .105 and Company B's mailServerB goes out on IP .110.  We may be hosting unique mail servers behind our firewall in the near future.

BAlfson, I also wanted mention that as I'm not using relaying at present (nor transparent mode) any issues with the configuration in Mail Security --> relaying is not causing me any issues at the moment.  However I reviewed your link (re: exchange server) and i didn't see anything there that would indicate the settings I would use would cause an error, at least from what i see, could you specify what problems you see with those settings?  I'm always trying to learn and if I can find a mistake before it bites me I'd appreciate it.

thanks again to you both for your postings..

Ryan
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 eomedia over 13 years ago in reply to BAlfson

Thanks for the replies.

I made one update based on dilandau's suggestion and removed the SMTP from the incoming DNAT rule.  This immediately solved the problem of inbound SMTP mail skipping the Astaro SMTP proxy - all inbound email is now being scanned by the gateway.  I knew i was missing something fairly simple and that was it, thank you!

This solution did however raise another issue in that we have people from outside the firewall that connect via IMAP to the mail server behind the firewall, and when they want to send an email from their remote location that email is sent as SMTP (port 25) and was now being caught by the firewall proxy instead of passing directly to the mail server.  They could still send email but when it reached the RCPT the header showed it as coming from the Astaro HELO instead of the mail server as would be the case for users sending from behind the firewall.

We solved this issue by having those remote users change their outgoing SMTP mail server port from 25 to 587 and adding a new DNAT rule on incoming port 587 to forward directly to the mail server and translating those requests back to port 25 - this way bypassing the Astaro gateway for those requests as they aren't truly inbound emails.

This solution solved our primary issues.

At present the outbound SMTP is not being scanned the the gateway because i am NOT using the Astaro relaying, which is okay for now as I need to review further how relaying outgoing through the gateway affects the DNAT rules we use now for ensuring email is delivered on the correct mail server WAN IP address (e.g. for RDNS issues, etc) instead of the default firewall IP.

If you have all mail going OUT on a single IP address, or multiple IP addresses for a single mail server it seems pretty straight forward, even with SMTP profiles to manage individual domains.  If however you have mail servers for more than one company going out on individual IP addresses it seems a little more tricky to ensure Company A's mailServerA goes out on IP .105 and Company B's mailServerB goes out on IP .110.  We may be hosting unique mail servers behind our firewall in the near future.

BAlfson, I also wanted mention that as I'm not using relaying at present (nor transparent mode) any issues with the configuration in Mail Security --> relaying is not causing me any issues at the moment.  However I reviewed your link (re: exchange server) and i didn't see anything there that would indicate the settings I would use would cause an error, at least from what i see, could you specify what problems you see with those settings?  I'm always trying to learn and if I can find a mistake before it bites me I'd appreciate it.

thanks again to you both for your postings..

Ryan
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data