Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we use a linux firewall with multiple external ip-addresses.let's say we have this:

webserver (   : (ext) -> (int) 
mailserver ( : (ext) -> (int)

this routings is done with simple port forwarding. but if the mailserver sends a mail it uses the first external ip-address (

it works quite well, but some smtp-servers treat our mails as spam. because is not covered with (this is fix).

i read some thing about bidirectional nat to accomplish this:

pseudo logic:

if destination port == smpt and source is internal {
   set external address

do u know how to do it?

is this a way to do it:

iptables -t nat -A POSTROUTING -s $INTERNAL_NET -d ! $INTERNAL_NET -dport SMTP -j SNAT --to $EXTERNAL_IP
share|improve this question
wouldn't be easier to bind the smtp daemon to one of the external ip addr ? – petre Sep 26 '10 at 15:21
no because it is in the DMZ. – mo01 Sep 26 '10 at 15:38
up vote 0 down vote accepted

Yes, this is basically the firewall rule you need. Watch out, it's --dport, i.e. you need a double dash.

An alternative would be to ask your ISP to put another reverse DNS record in place (also called PTR) for the second IP address, and then have a MX record using the same IP address with a higher value, so that delivery from outside is always attempted at the real server first.

share|improve this answer
thanku ! we can configure the dns-server by our self.i will check that! – mo01 Sep 26 '10 at 16:57
Usually you can configure the A, MX, and related records yourself. PTR records are usually held by the organization providing the IP address. – BillThor Sep 26 '10 at 17:52
this works, i can create all those records by my self. – mo01 Sep 29 '10 at 11:05

i would use iptables and iproute:

1.use iptables to mark the packets coming from mail server and going out to any, port 25

iptables -A PREROUTING -i <mailsrv_iface> -t mangle -p tcp --dport 25 -j MARK --set-mark 25

2.properly route the marked packets through the right interface

echo 25 mailgw >> /etc/iproute2/rt_tables
ip ru add fwmark 25 table mailgw
ip ro add default via <correct_mailgw_ip> dev <correct_mailgw_iface> table mailgw
share|improve this answer
looks also great, thx. the interface is same for all isn't easier to use just iptables? – mo01 Sep 26 '10 at 17:01
sure, in that case it's more about rewriting than routing and my answer is just 2cents. i made a wrong assumption about the existence of multiple interfaces and i decoupled the problem. my bad – sysfault Sep 26 '10 at 17:34

Have you considered forwarding the IP address to the mail server. Then it would be sending from the desired address. In that case you would not be using NAT for the mail server. Check the documentation for Shorewall for some examples.

share|improve this answer
no because the server is in a special subnet. i dont want to spagettify my iptables. – mo01 Sep 29 '10 at 11:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.