Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say I have two Rackspace Cloudservers, or VPSes for that matter. I want my setup to be:

  • Server1 would have my Apache web server
  • Server2 would have my mail server where I want to setup postfix+mysql (virtual users, etc).

Since Server1 is already visible to the web, I want that to be the domain for my mail. So let's say I have a domain whose MX records points to "", but Server2 has the mail server. So can I somehow get iptables to forward the packets to Server2 provided they're both on the same network? How would this affect user authentication on the mail server?

P.S. On this setup, I want all the non-web stuff outside Server1 to free up memory. I'm also thinking of having all the database in the email server (Or should I have another dedicated server for this?)



share|improve this question
up vote 0 down vote accepted

You can do this with iptables, which is part of the Linux kernel. On your "public" server, run:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 25 -j DNAT --to XXX.XXX.XX.XX:25
iptables -A INPUT -p tcp -m state --state NEW --dport 25 -i eth0 -j ACCEPT

where XXX.XXX.XX.XX is the IP address of the server you want to forward to. You may need to change "eth0" to whatever your device is called.

The first rule sets up the forwarding, and the second rule makes sure that connections to port 25 are accepted on the local server (i.e. both commands are necessary).

share|improve this answer

There are ways of doing this, like installing a mail forwarder on your web server.

What I would do, though, is just point the MX record to and not bother with redirection. Because it introduces complexity that you don't really need to have. If something happens to your mail, you're going to have to take into account the interaction of your web server, your forwarding rules, your software configurations, etc...the rule of thumb is that if you don't have to complicate it, don't.

Just use the mail server for serving mail and don't redirect things. Keep it simple.

share|improve this answer

I think this cries out for "why would you do that?!" Just edit's DNS zone and add something like A [server2'sIPAddress] and configure as the MX record for the domain. There's nothing that says a server can't have more than one name, or even more than one domain. Keep in mind if you're paying for bandwidth, piping traffic between servers basically doubles your usage (everything coming in goes right back out).

Now, if server2 is not internet accessible at all, then you'll need to use some form of connection forwarding. I'm assuming you're using Linux... rinetd is fairly simple to set up. You configure ports to listen on, and where those ports should go. All it does is whenever someone connects to it, it connects to the configured server and passes the data back and forth. With any kind of forwarding, one thing to keep in mind is that since the client thinks it's talking to server1, if you use SSL, the SSL certificate on server2 needs to match server1.

share|improve this answer
the problem with this is that, i want to use internal ip address for ip2 so that there will be no cost in bandwidth. – Ramon A. Feb 22 '11 at 16:40
+1 for mentioning a TCP proxy (rinetd). I'd rather use a TCP proxy than using a full blown layer 7 proxy (i.e. a protocol-specific SMTP "forwarder"). – Evan Anderson Feb 22 '11 at 16:55
@Ramon A. - I'm assuming you mean that bandwidth on Server2 is free if you use an internal IP address> If that's the case, you'll still be paying for it through the additional traffic that you're forwarding through from Server1. I agree with Bart on this one. No need to overcomplicate things. – SmallClanger Feb 23 '11 at 13:54
Yeah, took a step back and I think i'm really overcomplicating things. But it was worth exploring. My gratitude to everybody who answered. – Ramon A. Feb 23 '11 at 15:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.