Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Postfix instance on an EC2 server which will need to accept mail from the outside world (e.g. port 25 will be mapped to it from a virtual IP.)

I also want to use this server to send mail from my other EC2 machines. As EC2 doesn't map to the concept of a subnet which can be granted relay access, I'm thinking about running Postfix on a second port, and limiting access to that port by security group.

Ultimately I want port 25 to run like normal, and have port 26 accept mail for anyone who is able to connect to it.

Can this be done?

share|improve this question
up vote 3 down vote accepted

pjz's answer is close.

Add a couple lines to that looks something like this:

26 inet n - - - - smtpd
    -o mynetworks=

This will give you a second smtpd with mynetworks overridden from what is defined in You can override other variables in the same way; look at the commented-out examples that should already exist in the file.

share|improve this answer

Sure, you can do that. You'll need to edit your to add a listener on another port (right now there's a line like

smtp inet n - - - - smtpd

that you can duplicate as:

26 inet n - - - - smtpd

to add a listener on port 26.

Then you just need to allow the internal amazon IPs to connect to it by adding them to your mynetworks statement in; I'd just allow to connect since all your internal AMIs are guaranteed to be in that range. The manual of course has more details.

Edit: Drew Bloechl points out you can directly override mynetworks in the like so:

26 inet n - - - - smtpd -o mynetworks=

This configuration will apply whatever filtering, etc, rules you put into your config to everything that comes in on port 25, but will allow anyone from to connect to port 26 and send mail without having to pass all those checks.

share|improve this answer
Doesn't this means everyone with an EC2 instance can then relay through my server on port 25? – crb Jul 19 '10 at 16:18
No, only your other EC2 instances in the same security zone can see your server. Mine can't see yours and yours can't see mine. – pjz Jul 19 '10 at 17:41
But in order to get mail to be allowed for the domain I actually want, I need to open port 25 to the world... – crb Jul 19 '10 at 18:26
@crb - Right. If you do mynetworks=, you expose relay access to all EC2 instances. Any EC2 instance can relay mail through your server. That assumes you opened that port to the outside world. EDIT - or wait... expose port 25 to the world, then only open port 26 to your instances in that security group. Done. – BMiner May 22 '12 at 4:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.