There's nothing wrong with the VPN suggestions that have already been made, but sendmail is capable of handling this at the application layer.
If you want to do this, there are two parts: set up sendmail so that it supports TLS (encryption), and set up sendmail so that it supports relaying-after-SMTP-AUTH (which allows authentication over the encrypted SMTP channel, and tells sendmail to allow relaying from clients who have so authenticated).
For TLS support, you need the following in your sendmail.mc
:
define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confSERVER_CERT', `/etc/pki/tls/certs/server.crt')dnl
define(`confSERVER_KEY', `/etc/pki/tls/certs/server.key')dnl
You will also need to create the (self-signed) certificate and key files; there are a lot of tutorials out on the net about doing that, so I don't propose to go over it again here.
For SMTP AUTH and relaying support, you need the following in your sendmail.mc
:
define(`confAUTH_OPTIONS', `A p y')dnl
TRUST_AUTH_MECH(`LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl
I also found that I needed the following line in /etc/sasl2/Sendmail.conf
:
pwcheck_method:saslauthd
and that saslauthd
needed to be running. That enabled me to log in using the same credentials that I use to authenticate against dovecot, and sendmail was then happy to relay my emails.