How to let Postfix relay mails at least once

Question

Setup:

Internet <> Firewall
Firewall <> DMZ (192.168.200.0/24)
Firewall <> Green (192.168.100.0/24)

192.168.200.11: Proxmox-Mail-Gateway
192.168.200.12: Postfix

I have set up a Mail-Server-VM (192.168.200.12) with a Mail-Gateway (192.168.200.11). This is working perfectly for Mails coming from clients to other server ([email protected] sending to [email protected]) and the other way round ([email protected] sending to [email protected]). So the Mail-Gateway can filter spam and virus infected mails. Now I want this filter to apply also to inbound mails ([email protected] sending to [email protected]). So these mails will be secure too.

Now my question: How must I alter my postfix configuration so that only mails coming from the Gateway(192.168.200.11) will be saved in the inbox and every other be relayed?

Postfix - main.cf - customizations:

mydestination           myDomain.com
mynetworks              192.168.200.0/24
inet_protocols          ipv4
relay host              [192.168.200.11]:26
mail_spool_directory    /var/mail/Maildir/

Edit:
My current circuits are:

External servers -> Mail Gateway -> Postfix -> Save on Disk (Extern to Intern)
Internal user Clients -> Postfix -> Mail Gateway -> External Servers (Intern to Extern)
Internal user Clients -> Postfix -> Save on Disk (Inbound)

The last should be like:

Internal user Clients -> Postfix -> Mail Gateway -> Postfix -> Save on Disk (Inbound)

As far as I searched there is no convenient way in the Proxmox-Mail-Gateway to set this circuit:

Internal user Clients -> Mail Gateway -> Postfix -> Save on Disk (Inbound)

Answer 1

I think the simple solution is to use your Mail Gateway as the outgoing server for your inside clients. Mail Gateway will then do its thing and pass them on to Postfix, just like it does for mail coming from external.

It's not really stated that way in your question but from what I understand and deduce, right now your traffic path is as follow:

External servers -> Mail Gateway -> Postfix -> Mail delivery agent
Internal user clients -> Postfix -> External servers
Internal user clients -> Postfix -> Mail delivery agent

So what I propose is that your Postfix be only used as a relay, never as outgoing server, thus changing:

Internal user clients -> Postfix -> External servers
Internal user clients -> Postfix -> Mail delivery agent

To:

Internal user clients -> Mail Gateway -> Postfix -> External servers
Internal user clients -> Mail Gateway -> Postfix -> Mail delivery agent

Maybe you don't even need Postfix in this case, would need to know more about everything else you may be doing or needing.