Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a strange issue with postfix that is driving me a little up the wall as it seems to work 50% of the time but with no changes made.

What I want to achieve:

I have a number of virtual servers on a few different external networks e.g. 1.2.3.4/24 10.20.30.40/24 11.22.33.44/24

I have set up 4 postfix servers with round robin dns, they all have the same main.cf config file.

I want only servers in those external subnets to be allowed to relay through the mail servers, no username or password required.

I did some reading and it seemed that the mynetworks option was the way to go however it only seems to work 50% of the time, even if I take the other 3 servers out of the picture and leave 1 mail server running 50% of the time I get relay denied errors.

here is the config in use:

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

append_dot_mydomain = no

readme_directory = /usr/share/doc/postfix

smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = relay.example.co.uk
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = relay.example.co.uk, localhost.example.co.uk, , localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mynetworks = 1.2.3.4/24
mynetworks = 10.20.30.40/24
mynetworks = 11.22.33.44/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
smtpd_error_sleep_time = 2s
smtpd_hard_error_limit = 20
smtpd_recipient_restrictions = permit_mynetworks

I suspect that the mydestination may have a part to play here but any help is welcome?

share|improve this question
1  
update: I may have actually answered my own question: It seems it is not correct to stack the mynetworks, instead they should be entered as: mynetworks - 1.1.1.1/24 2.2.2.2/24 on a single line. Testing this now, all looks good so far, happy to hear any other comments though regarding cleaning up the config etc. –  Backtogeek Oct 15 '12 at 10:00
    
You are running 4 postfix servers with the same A record WHY, exactly ? This appears to me the root of the issue. Well, that, and the fact that you're not using submission. –  adaptr Oct 15 '12 at 15:26

1 Answer 1

up vote 1 down vote accepted

Acording to postconf(5) man page:

When the same parameter is defined multiple times, only the last instance is remembered.

This means that the definition of your mynetworks variable should look something like this:

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 1.2.3.4/24 10.20.30.40/24      11.22.33.44/24

or

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
 1.2.3.4/24
 10.20.30.40/24
 11.22.33.44/24

or

mynetworks = 127.0.0.0/8, [::ffff:127.0.0.0]/104, [::1]/128,
 1.2.3.4/24,
 10.20.30.40/24,
 11.22.33.44/24,
share|improve this answer
    
which would explain why it was working some of the time. –  Backtogeek Oct 15 '12 at 10:16
    
Actually since setting the config again like that all I get are timeouts now, I can telnet to port 25 but when sending mail nothing happens: Oct 15 11:53:55 relay postfix/master[889]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling –  Backtogeek Oct 15 '12 at 11:54
    
what about mydestination = relay.example.co.uk, localhost.example.co.uk, , localhost ? There is an extra ` ,` before localhost. Also, make sure if you use one IP/network block per line, either put one or more sapce/tabs before (this tells postfix that this line continues the previous one) –  Torian Oct 15 '12 at 12:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.