Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a bit of a problem in that I am trying to forward mail on through Haproxy but to entirely different servers.

The problem I am having is that there are multiple backends all going to different places and different sites. I am currently using the following listen configuration to do this however I know that hdr_sub(host) does not obtain the correct information for getting emails to their intended destination.

listen Mail_Handler
        mode                     tcp
        bind                     :25
        # Set timeouts
        timeout client          15s
        timeout connect         30s
        timeout server          30s
        rate-limit sessions     30

        ################## ACL Handlers ####################
        acl domain1.com hdr_sub(host) -i domain1.com
        acl domain2.com hdr_sub(host) -i domain2.com

        use_backend domain1.com if domain1.com
        use_backend domain2.com if domain2.com

So for example I have domain1.com and domain2.com and the MX record for domain1.com is

0 domain1.com

How is it possible to ensure that mail sent to the MX handler for domain1.com actually reaches domain1.com and the same with domain2.com. I am filtering the mail server too to prevent potential attackers obtaining the true IP

Is there any specific header I can use that will allow me to determine where the mail is destined for? Or any other way around doing this? If it is any benefit I am using Haproxy 1.4

Appreciate your help.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

As explained in configuration.txt, when you use TCP mode..." no layer 7 examination will be performed." and hdr_sub is a layer 7 examination (7.5.3. Matching at Layer 7).

You can work only at level 4 and below (7.5.1. Matching at Layer 4 and below).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.