How to make Postfix use another IP address?

Question

I'm using the Postfix mail server and I have 6 IPs available. I'd like to use another IP for the Postfix mail server for sending mail than the web server uses.

How can I do this? My postfix version is 2.3.3.

For example: main IP: 66.66.66.66 other IP: 66.66.66.67

Answer 1

You want smtp_bind_address=66.66.66.67 and inet_interfaces=all or inet_interfaces=eth(whatever) that 66.66.66.67 is on.

Make that change, then stop/start postfix. You can't just reload if you're changing inet_interfaces

Answer 2

If you use the "smtp_bind_address" solution then your mail server will only listen on that specified IP address for incoming mail as well. The same thing applies to the "inet_interfaces" solution. This may not be the desired soltution if you want to listen for incoming mail on multiple IP addresses/interfaces.

My solution is better, because I suggest not to change the default "smtp_bind_address" and "inet_interfaces" settings, so your mail server will still listen for incoming mail on all IP addresses.

Only need to make a small change in your /etc/postfix/master.cf file.

Change this part:

smtp      unix  -       -       -       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       -       -       -       smtp
        -o smtp_fallback_relay=

to this:

smtp      unix  -       -       -       -       -       smtp
        -o smtp_bind_address=192.168.0.1
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       -       -       -       smtp
        -o smtp_bind_address=192.168.0.1
        -o smtp_fallback_relay=

Of course, instead of 192.168.0.1 you must use one of your IP addresses, the one you want to send your mail from.

Zoltan

Answer 3

master.cf

Create different Interfaces. One for each domain:

rotate1  unix -       -       n       -       -       smtp
          -o syslog_name=postfix-rotate1
          -o smtp_helo_name=domainone.com.br
          -o smtp_bind_address=173.111.111.1

rotate2  unix -       -       n       -       -       smtp
          -o syslog_name=postfix-rotate2
          -o smtp_helo_name=domaintwo.com.br
          -o smtp_bind_address=173.111.111.2

main.cf

1. Disable all other transport maps, i.e.: # transport_maps = xxxxx

2. Enable dependent transport map (require postfix 2.7.x or later)

sender_dependent_default_transport_maps = mysql:/etc/postfix/config/transport_random_dependent.cf

transport_random_dependent.cf

Example:

user = postfix
password = mypassword
dbname = postfixdb
hosts = localhost
query = SELECT transport FROM transport_random WHERE domain = '%d' AND status='1' ORDER BY RAND() LIMIT 1

Table transport_random

Column "transport" = rotate1, rotate2, rotate3, rotate4 (etc)
Column "domain" = sender domains (replaced by %d)
Column "status" = boolean (0 or 1) if is enabled the transport.

The instruction "RAND() LIMIT 1" is necessary only if you want to use random transports for the same domain.

In example, you want to send from mydomain.com from 3 different IPs.

Then, you create 3 transports (rotate1, rotate2 and rotate3) with 3 different IPs, then set at mysql lines:

transport = rotate1 | domain = mydomain.com
transport = rotate2 | domain = mydomain.com
transport = rotate3 | domain = mydomain.com

Then, when postfix will randomize three different transports (rotate one to three) to send this emails.

Answer 4

Edit /etc/postfix/main.cf and make sure that the following line is present

inet_interfaces = 66.66.66.67, localhost

Then run "postfix reload"

Answer 5

If it's off a contiguous IP block given to you that hits your WAN gateway and you want to have a host use a different address than first one that shows on WAN, you will have to create a NAT/firewall solution. Ignore the rest of answers, if so. They're going about it the wrong way in that case.

And more generally, since this is for an email server, you definitely want a policy to force outgoing connections to reflect the chosen public IP you used. Otherwise reverse DNS checks, SPF checks, etc. will fail.

I usually don't post 3rd party/commercial websites as they tend to vanish, but similar to this:

https://www.sonicwall.com/support/knowledge-base/how-do-i-present-to-the-internet-an-internal-ip-with-another-public-ip-from-the-wan-subnet/180919132734964/

^ Pretty easily applied to other firewalls/devices.

You will also need a policy to do the opposite as well. Only allow inbound traffic from the public IP you want to hit the given LAN server. But, you may have already figured that much out.

If needing to present (listening, or otherwise) more than one public IP from the actual server (www versus email in your case), the other approved answer here will work. Even so, you should still set your WAN<->NAT<->LAN up correctly, though as per above before configuring software side/postfix/apache/nginx/et al.