This is similar to my exim setup. From within my network I can send email to any domain, but from outside the network the only mail exim will deliver to is my local domain, unless the user authenticates to exim first. In this way, I can send mail through my mailserver from anywhere in the world, as long as I authenticate first.
Critical sections of my config are:
domainlist local_domains = @ : example.com
domainlist relay_to_domains =
hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/24 : 2001:111:1111::/64
This basically sets my local domain for which exim knows is 'home' to example.com
. It also sets out the subnet ranges for which exim is allowed to relay any mail. relay_to_domains
is blank, because there are no other domains for which I blanket will relay to, other than example.com
.
tls_advertise_hosts = *
I advertise TLS availability so that any client can authenticate over TLS.
acl_check_rcpt:
[...]
accept hosts = +relay_from_hosts
accept authenticated = *
require message = relay not permitted
domains = +local_domains : +relay_to_domains
This acl does some checks on where the mail is going, and who sent it before deciding whether or not to relay. The first line relays mail from hosts within the previously defined internal network. The second line relays mail from any authenticated user. The third and fourth require that if any previous condition has not been met, only relay for my local domains.
The final section is the authenticators, so that exim knows what an authenticated user looks like. Mine looks like this:
plain_saslauthd_server:
driver = plaintext
public_name = PLAIN
server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
server_set_id = $auth2
server_prompts = :
login_saslauthd_server:
driver = plaintext
public_name = LOGIN
server_prompts = "Username:: : Password::"
# don't send system passwords over unencrypted connections
server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
server_set_id = $auth1
Obviously this requires an exim build that's got sasl capability compiled, along with a working SASL daemon on the system. I use Cyrus SASLD and from memory, it's fairly simple to install and forget about.
I'm actually running this on OpenBSD, so not sure how these steps would exactly translate to a split-config Ubuntu box. However, it should be enough to get you going :)