This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Setup Mail Security inbound outbound scanning

I've searched the forums fairly extensively but can't seem to find a solution that matches the concern that i have so I'm going to post it here and see if I can get some help.

If you do respond please feel free to explain like I'm a 4 year old who needs explicit directions.

Astaro Security Gateway 8.003

I have a single mail server that sits behind the firewall and is connected to via external IMAP users as well as being the primary mail server that sends email.

Firewall
WAN:  ***.***.***.100
LAN:  10.0.0.1

Mail Server (mail-01)
WAN:  ***.***.***.105
LAN:  10.0.0.5   [Definitions->Networks->Host]

Mail Security --> Routing
* Domains (example.com) - added
* Route by: Static Host List
* Host List (mail-01)
* With Callout

Mail Security --> AntiVirus
* AntiVirus check footer CHECKED

Mail Security --> AntiSpam
* Reject at SMTP Time:  Confirmed Spam
* Advanced anti-spam features:  ALL CHECKED

Mail Security --> Exceptions
* NONE

Mail Security --> Relaying
* Allow Authenticated Relaying - CHECKED
* Allowed users/groups (email security group - custom created)
* Allowed hosts/networks (Internal (network))
* Scan relaying (outgoing) messages - CHECKED

Mail Secuirty --> Advanced
* NONE (other than default Advanced settings)

DNAT/SNAT - NETWORK SECURITY

Inbound Mail DNAT
Any --> Email Messaging (IMAP,POP3,SMTP + all SSL versions) --> Ext WAN .105 --> mail-01

Outbound Mail SNAT
mail-01 --> SMTP --> Any -->Ext WAN .105

RESULTS OF ABOVE CONFIGURATION

I can send and receive email correctly.
The mail server is configured to ensure it is not an open relay.
The email header when delivered shows the correct HELO from the mail server.

The issue is that it appears that neither inbound or outbound emails are being scanned by the Astaro firewall.

This makes sense in regards to the outgoing email as am I'm not relaying through the Astaro.  I would have thought however that the antiVirus and antiSpam features of the Astaro gateway would still be in effect on inbound email.

I am getting a TON of spam emails in my inbox with this current configuration and the mail manager shows that there are NO stored or quarantined messages which makes me believe that Astaro is not scanning those messages.

OPTION TWO

Mail Security --> Advanced
* Use Transparent Mode - CHECKED

This change appears to intercept inbound and outbound SMTP traffic (as indicated in info), which on the surface seems to be the solution.

This change however means that all outbound email now goes out on WAN ***.***.***.100 instead of ***.***.***.105 as before.  In order to solve this I add the SNAT rule;

Ext WAN .100 --> SMTP --> Any -->Ext WAN .105

This forces SMTP traffic on the firewall to use the Ext mail IP that I have all my RDNS setup on.

While this solution would work if I only ever have a single mail server behind the firewall, as soon as I would add a second internal mail server  I would have the problem of trying to redirect SMTP traffic on Ext WAN .100 to more than one Ext WAN IP address which I don't think Astaro can do.

DESIRED SOLUTION

I want to have a mail server (or multiple mail servers should I need) behind the firewall that can send outbound email which can be scanned by Astaro prior to being sent.  I also want all incoming SMTP mail to that mail server to be scanned by Astaro for virus and spam before it reaches my mail server.

It does not matter if all SMTP authentication is done by the mail server itself (as present configuration does), or if I need to utilize Authenticated relay with allowed users/groups as would be required with Transparent Mode.

My current configuration works but seems to bypass Astaro which seems to defeat the benefits offered by Astaro.  I'm a little lost on what piece of this i'm missing, whether it's configuring Interfaces & Routing --> Static routing or whether Astaro really is scanning inbound and I'm just not seeing it.

At the very least I want Astaro to scan inbound email, outbound is a "nice to have" not a "need to have".

Any thoughts, suggestions and/or detailed ideas you have would be greatly appreciated.

Thanks

Ryan

This thread was automatically locked due to age.

Parents

0 BAlfson over 13 years ago

We solved this issue by having those remote users change their outgoing SMTP mail server port from 25 to 587 and adding a new DNAT rule on incoming port 587 to forward directly to the mail server and translating those requests back to port 25 - this way bypassing the Astaro gateway for those requests as they aren't truly inbound emails.

That's a good solution.  Another solution, if you have an unused public IP, is to use it for an Additional Address on the External interface.  Then you can DNAT port 25 without interrupting the SMTP Proxy.  This also allows you to create a new A record in public DNS; for Exchange, we typically configure outlook.example.com for these accesses.  In internal DNS, if it's not already there, we add a forward lookup zone for example.com and create an entry there for outlook that points at the internal IP; this allows laptop users to connect internally or via VPN and still reach the mail server with the same FQDN.

At present the outbound SMTP is not being scanned the the gateway because i am NOT using the Astaro relaying, which is okay for now as I need to review further how relaying outgoing through the gateway affects the DNAT rules we use now for ensuring email is delivered on the correct mail server WAN IP address (e.g. for RDNS issues, etc) instead of the default firewall IP.

This is the reason the recommended approach is to have mail.example.com point at the primary IP on the External interface.  I suspect you meant that you were using a SNAT rule like 'Mail Server -> SMTP -> Internet : SNAT from External [Mail] (Address)'.  If you configure relaying through the proxy, just replace "Mail Server" in your SNAT with "External (Address)" and configure your mail server to use the IP of Astaro's "Internal (Address)" as a smarthost.

What you're doing will work just fine.  I sometimes try here to combine my knowledge with that of all posters to create single, "best practice" posts; you'll often see that I've updated such posts several times when something new should be added.  Normally, the reason to do it one way in Astaro is because it's the clearest configuration for Astaro, and it facilitates changes and the addition of new capabilities without requiring rethinking an old workaround.

I dislike configuring "Transparent" mode because it means that if a PC gets a trojan, it can become a spambot.  You'll be on RBLs within hours and it will cause multiple headaches.

I'm not sure why there would be a problem with sending or receiving emails for multiple domains on a single IP.  The Astaro SMTP Proxy knows how to route incoming emails to individual internal servers based on domain names.  As long as the MX records for the other domains all point to the same IP and there's the approriate rDNS entry for each domain, you should have no problem.

Thanks for the well-written post and, again, welcome to the community.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 13 years ago

We solved this issue by having those remote users change their outgoing SMTP mail server port from 25 to 587 and adding a new DNAT rule on incoming port 587 to forward directly to the mail server and translating those requests back to port 25 - this way bypassing the Astaro gateway for those requests as they aren't truly inbound emails.

That's a good solution.  Another solution, if you have an unused public IP, is to use it for an Additional Address on the External interface.  Then you can DNAT port 25 without interrupting the SMTP Proxy.  This also allows you to create a new A record in public DNS; for Exchange, we typically configure outlook.example.com for these accesses.  In internal DNS, if it's not already there, we add a forward lookup zone for example.com and create an entry there for outlook that points at the internal IP; this allows laptop users to connect internally or via VPN and still reach the mail server with the same FQDN.

At present the outbound SMTP is not being scanned the the gateway because i am NOT using the Astaro relaying, which is okay for now as I need to review further how relaying outgoing through the gateway affects the DNAT rules we use now for ensuring email is delivered on the correct mail server WAN IP address (e.g. for RDNS issues, etc) instead of the default firewall IP.

This is the reason the recommended approach is to have mail.example.com point at the primary IP on the External interface.  I suspect you meant that you were using a SNAT rule like 'Mail Server -> SMTP -> Internet : SNAT from External [Mail] (Address)'.  If you configure relaying through the proxy, just replace "Mail Server" in your SNAT with "External (Address)" and configure your mail server to use the IP of Astaro's "Internal (Address)" as a smarthost.

What you're doing will work just fine.  I sometimes try here to combine my knowledge with that of all posters to create single, "best practice" posts; you'll often see that I've updated such posts several times when something new should be added.  Normally, the reason to do it one way in Astaro is because it's the clearest configuration for Astaro, and it facilitates changes and the addition of new capabilities without requiring rethinking an old workaround.

I dislike configuring "Transparent" mode because it means that if a PC gets a trojan, it can become a spambot.  You'll be on RBLs within hours and it will cause multiple headaches.

I'm not sure why there would be a problem with sending or receiving emails for multiple domains on a single IP.  The Astaro SMTP Proxy knows how to route incoming emails to individual internal servers based on domain names.  As long as the MX records for the other domains all point to the same IP and there's the approriate rDNS entry for each domain, you should have no problem.

Thanks for the well-written post and, again, welcome to the community.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 eomedia over 13 years ago in reply to BAlfson

That's a great idea to use the FQDN (internal and external) to have requests to the mail server from clients come in on a different IP address altogether - avoids all confusion between client connections and mail server traffic.

This is the reason the recommended approach is to have mail.example.com  point at the primary IP on the External interface. I suspect you meant that you were using a SNAT rule like 'Mail Server -> SMTP -> Internet : SNAT from External [Mail] (Address)'. If you configure relaying through the proxy, just replace "Mail Server" in your SNAT with "External (Address)" and configure your mail server to use the IP of Astaro's "Internal (Address)" as a smarthost.

We are indeed using the SNAT rule like you indicated, for RDNS resolution.  In the above you are indicating that you would take a single WAN IP and designate it as the mail IP address which then all SMTP traffic outbound on Astaro would be routed through?  This would enable ASG to take traffic from multiple sources and route them all through a single WAN IP with a single SNAT rule?  I just want to make sure I understand correctly.

Our concern with the multiple internal mail servers is that we would likely want/need to separate the mail servers by IP address instead of using the single IP for all.  I realize that Astaro could route and manage multiple mail servers on a single IP with routing, however separation is due more to use case and networks.

One of the new mail servers would be dealing with email marketing (legit) and separating that from our own traffic seems advisable.

At present we could certainly add another email server and set the SNAT rules to ensure it goes out on the correct WAN IP, and all inbound emails would still work fine with our current setup.  Our issue would occur if we decided to relay outgoing email through ASG if we had multiple IP addresses for the mail servers, I think.

Anyway thanks for your insight on this stuff, it's very helpful to get a fresh look at things.

Ryan
Cancel
Vote Up 0 Vote Down

Cancel