iptables bidrectional nat / twice nat for smtp

Question

we use a linux firewall with multiple external ip-addresses.let's say we have this:

webserver (www.blabla.com)   : (ext)10.0.0.1 -> (int)172.99.0.2 
mailserver (mail.blabla.com) : (ext)10.0.0.2 -> (int)172.99.1.2

this routings is done with simple port forwarding. but if the mailserver sends a mail it uses the first external ip-address (10.0.0.1).

it works quite well, but some smtp-servers treat our mails as spam. because 10.0.0.1 is not covered with mail.blabla.com (this is fix).

i read some thing about bidirectional nat to accomplish this:

pseudo logic:

if destination port == smpt and source is internal 172.99.1.2 {
   set external address 10.0.0.2
}

do u know how to do it?

is this a way to do it:

iptables -t nat -A POSTROUTING -s $INTERNAL_NET -d ! $INTERNAL_NET -dport SMTP -j SNAT --to $EXTERNAL_IP

Answer 1

Yes, this is basically the firewall rule you need. Watch out, it's --dport, i.e. you need a double dash.

An alternative would be to ask your ISP to put another reverse DNS record in place (also called PTR) for the second IP address, and then have a MX record using the same IP address with a higher value, so that delivery from outside is always attempted at the real server first.

Answer 2

wouldn't be easier to bind the smtp daemon to one of the external ip addr ?

Answer 3

i would use iptables and iproute:

1.use iptables to mark the packets coming from mail server and going out to any, port 25

iptables -A PREROUTING -i <mailsrv_iface> -t mangle -p tcp --dport 25 -j MARK --set-mark 25

2.properly route the marked packets through the right interface

echo 25 mailgw >> /etc/iproute2/rt_tables
ip ru add fwmark 25 table mailgw
ip ro add default via <correct_mailgw_ip> dev <correct_mailgw_iface> table mailgw

Answer 4

Have you considered forwarding the IP address to the mail server. Then it would be sending from the desired address. In that case you would not be using NAT for the mail server. Check the documentation for Shorewall for some examples.