0

Is it possible to proxy emails - with postfix for example - transparently so the backend mail server will get the last SMTP server IP address (rbl purpose) and not the Proxy IP address?

If it is possible and in the same mind could the SMTP proxy route emails by recipient domain to different backends?

2 Answers 2

0

What you are asking is mostly possible, but there is a few caveats. I tried writing such a proxy myself several years ago, but there is a few challenges, that I never completely resolved.

The way I see it, the property which would define the difference between a proxy and a full relay is this: The proxy never on its own takes responsibility for the mail.

A relay will receive the mail from a sending host and at the end of DATA confirm to the sending host, that it is taking responsibility for delivery of the mail. That means it must already at that time be persistent on disk on the relay, and the sending host can forget about it.

The proxy on the other hand would connect to the back end while still receiving the mail from the sending host. The proxy doesn't accept responsibility for the mail by itself. Rather the proxy receives promise from the backend taking responsibility for the mail and simply proxies that message back to the sending host.

But now comes the largest challenge in this sort of proxy: There may be multiple backends. Suppose the sending host sends you not just one, but multiple recipient addresses, and those resolve to different backends. Are you going to open SMTP sessions with each backend while still receiving from the client?

If you delay confirmation to the client at the end of DATA until you have received confirmation from every backend, then you may often find yourself in a situation, where you have received confirmation from some backends but not all of them. If you report success to the client, you take the responsibility to deliver it to all of the backends. If you report failure, or the client times out, the client will retransmit without knowing, that the mail has already been delivered to some of the recipients.

SMTP by design does introduce the possibility of mail duplication in such scenarios. Good software on the receiving end can deduplicate when two copies are received with identical recipient, Message-ID, and content. But the proxy with multiple backends scenario will make such duplication much more likely, and it could easily happen multiple times for the same mail.

How do you then preserve the client IP when communicating with the backend? The path I took was to embed it in the domain, I send in the HELO command to the backend. I could send a domain looking like <IP>.example.com inserting my own domain of course. I could even include the domain from the original HELO command before or after the IP address.

I would also insert a full and properly formatted Received header before forwarding the mail. The Received header is probably the best way to get the IP address to the backend, because it is fairly standardized, so the backend should be able to parse it.

Actually spoofing the IP of the original client when communicating with the backend is also technically possible in certain situations, but it is complicated. You are not just doing forwarding or NAT, you have to terminate TCP connections on the proxy, so it is an entirely new TCP connection.

If the network route from the backend to the client IP address takes the packets through the proxy, then it is of course possible for the proxy to spoof the IP address of the client. But simultaneously having the same IP address as local address on some TCP connections and remote address on other TCP connections is likely to confuse the TCP layer. You can opt not to do any spoofing in the TCP layer itself and instead have a separate component, which is somehow instructed on how to NAT the traffic.

This may be doable with a standard NAT implementation like iptables in the following way. The proxy first binds to a local IP address and port number. It then insert an iptables NAT rule, that specifies that outgoing packets with the specific combination of source IP and port as well as destination IP and port must be NATed to the source IP of the client. Before the proxy actually performs the connect system call, it does know all of those addresses and port numbers, so it can create an entirely targeted iptables rule, which will match this one TCP connection and nothing else.

1
  • I'm impressed, thanks for the explaination. I think I will try to categorize spam at relay level by adding some header, it seems easier.
    – Arka
    Jul 10, 2014 at 21:01
0

You can have postfix to rewrite headers to get to desirable results, but it will NEVER be transparent as that would break some RFC.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .