0

My mail server is protected from spam by our Barracuda appliance. I'm trying to configure EXIM to forward ALL outbound messages to the Barracuda server first, including mail for local domains. Once the messages are scanned and allowed, the Barracuda server will then deliver local mail back to my mail server where the EXIM config will allow them to be delivered. I believe I can achieve this with a conditional definition for the "domains =" portion of the config below ,but I'm unsure of the sytax:

RoutetoBarracuda:

driver = manualroute

domains = ?

transport = remote_smtp

route_list = * barracuda.mydomain.com

ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8

no_more

Can I write an "if/else" statement for "domains" where (in plain English):

domains = ! +local_domains (everything but local domains) if the sender is my Barracuda server else * (forward all domains to Barracuda) if the sender is any other host/IP address.

Since I can't trust my users to not spam each other, the desired action is to have EXIM forward local to local mail from a sender off to the Barracuda server first and recognize when it comes back, so that it can then be delivered locally.

I hope this question makes sense. I'm unsure about the syntax to make above work.

Feel free to let me know if there's a better way to do this.

3
  • I suspect you really should be running two mail servers in this case, one to deliver inbound mail and one to process outbound mail. Oct 7, 2013 at 16:52
  • A two mail server configuration is actually what I'm moving away from. I want to give our mobile users the ability to authenticate and send email from the same server as inbound "mail.mydomain.com". Oct 7, 2013 at 18:04
  • The following almost gives me what I want: domains = ${if eq{$sender_host_name}{barracuda.mydomain.com}{! +local_domains}{*}} However it isn't the sender's hostname I want to do the comparison against, but rather the server relaying the email. A variable like $relay_host_ip_address might do the trick, if it existed. Oct 7, 2013 at 20:16

3 Answers 3

0

I'm logging in from my main account to give an update. I tried this which had the desired results

domains = ${if eq{$interface_port}{587}{*}{! +local_domains}}

If my clients are configured to send on port 587 and my Spam Gateway relays on port 25 then I get the desired result. Restricting outbound SMTP on port 587 remotely and 25 locally makes sense anyway as many ISPs do not allow outbound port 25 unless it's through their SMTP servers.

I'll update this thread if there are any gotchas with this method.

0

I would use a hosts = ... check in an ACL (eg, one defined for acl_smtp_connect) to set a variable such as $acl_c_is_from_barracuda to be yes or no; also have an ACL for acl_not_smtp_start which sets the same variable to no. The most reliable check you have is "did this come back to us from the Barracuda"; if not, you want to send it to the barracuda. Just be sure you don't add new IPs to those filtering boxes without updating Exim, or you'll have a mail-loop.

If you want to protect against that possibility, you might have the filter boxes send to port 26 instead of 25 on your Exim server, and have IP filters which only allow access to that port from the filter boxes, and do set acl_c_is_from_barracuda = yes based upon $received_port.

You can then have the first Router be called barracuda_filter and include:

condition = ${if !bool{$acl_c_is_from_barracuda}}

So, if it's not from the barracuda, send it to the barracuda.

Then the later Routers send the mail out normally.

0

Without using acls you may use in your router:

condition = ${if !eq{$sender_host_name}{barracuda_hostname}}

or

condition = ${if !eq{$sender_host_address}{barracuda_ipaddress}}

if the host's address has no ptr record in dns.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .