0

we use a linux firewall with multiple external ip-addresses.let's say we have this:

webserver (www.blabla.com)   : (ext)10.0.0.1 -> (int)172.99.0.2 
mailserver (mail.blabla.com) : (ext)10.0.0.2 -> (int)172.99.1.2

this routings is done with simple port forwarding. but if the mailserver sends a mail it uses the first external ip-address (10.0.0.1).

it works quite well, but some smtp-servers treat our mails as spam. because 10.0.0.1 is not covered with mail.blabla.com (this is fix).

i read some thing about bidirectional nat to accomplish this:

pseudo logic:

if destination port == smpt and source is internal 172.99.1.2 {
   set external address 10.0.0.2
}

do u know how to do it?

is this a way to do it:

iptables -t nat -A POSTROUTING -s $INTERNAL_NET -d ! $INTERNAL_NET -dport SMTP -j SNAT --to $EXTERNAL_IP
2
  • wouldn't be easier to bind the smtp daemon to one of the external ip addr ?
    – quaie
    Sep 26, 2010 at 15:21
  • no because it is in the DMZ.
    – mo01
    Sep 26, 2010 at 15:38

3 Answers 3

0

Yes, this is basically the firewall rule you need. Watch out, it's --dport, i.e. you need a double dash.

An alternative would be to ask your ISP to put another reverse DNS record in place (also called PTR) for the second IP address, and then have a MX record using the same IP address with a higher value, so that delivery from outside is always attempted at the real server first.

3
  • thanku ! we can configure the dns-server by our self.i will check that!
    – mo01
    Sep 26, 2010 at 16:57
  • Usually you can configure the A, MX, and related records yourself. PTR records are usually held by the organization providing the IP address.
    – BillThor
    Sep 26, 2010 at 17:52
  • this works, i can create all those records by my self.
    – mo01
    Sep 29, 2010 at 11:05
0

i would use iptables and iproute:

1.use iptables to mark the packets coming from mail server and going out to any, port 25

iptables -A PREROUTING -i <mailsrv_iface> -t mangle -p tcp --dport 25 -j MARK --set-mark 25

2.properly route the marked packets through the right interface

echo 25 mailgw >> /etc/iproute2/rt_tables
ip ru add fwmark 25 table mailgw
ip ro add default via <correct_mailgw_ip> dev <correct_mailgw_iface> table mailgw
2
  • looks also great, thx. the interface is same for all ips.so isn't easier to use just iptables?
    – mo01
    Sep 26, 2010 at 17:01
  • sure, in that case it's more about rewriting than routing and my answer is just 2cents. i made a wrong assumption about the existence of multiple interfaces and i decoupled the problem. my bad
    – user237419
    Sep 26, 2010 at 17:34
0

Have you considered forwarding the IP address to the mail server. Then it would be sending from the desired address. In that case you would not be using NAT for the mail server. Check the documentation for Shorewall for some examples.

1
  • no because the server is in a special subnet. i dont want to spagettify my iptables.
    – mo01
    Sep 29, 2010 at 11:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .