Feature request: show and allow disabling automatically trusted local subnets

[Covalenco_S]

Hello,

I am running Proxmox Mail Gateway 9.1.0 with two network interfaces:

ens192 public-address.240/24
ens224 192.168.10.240/24

Under Configuration > Mail Proxy > Networks, I configured only explicit /32 trusted hosts. The public /24 subnet is not displayed in the GUI and is not present in /etc/pmg/mynetworks.

However, the generated Postfix configuration contains the entire directly connected public subnet:

postfix.mynetworks = 127.0.0.0/8 192.168.10.250/32 ... public-address.0/24 ... [::1]/128

The subnet appears to be derived automatically from the PMG interface configuration.

I understand that this is currently documented behavior and that directly connected networks are automatically trusted for the internal SMTP port. I also understand that it can be overridden by maintaining a custom /etc/pmg/templates/main.cf.in.

However, the effective trusted subnet is not visible in the PMG GUI. An administrator reviewing Configuration > Mail Proxy > Networks may therefore assume that only the explicitly listed /32 hosts are trusted.

Could PMG provide the following options?

1. Display automatically generated trusted networks in the GUI as read-only entries.
2. Add an option to disable automatic trust of directly connected subnets.
3. Allow administrators to use only explicitly configured trusted hosts without overriding the complete main.cf.in template.
4. Show a warning when the internal SMTP port is reachable through a public-addressed interface.

Maintaining a complete custom Postfix template only to remove one implicit subnet also requires comparing the custom template after every PMG update.

Is there currently a supported PMG 9 method to disable the automatically added subnet while continuing to manage explicit trusted hosts through the GUI?

Thank you.

 

[carsten2]

I also ran into this problem and was very surprised that the mail gateways actually creates a "secret" open relay for every machine in the local network, without even displaying it in the GUI and not able to disable it, without patching. I think it is a very central security part of every mail gateway to restrict who can send mails over it.

So two problems, which should really be fixed:
1) Show what is really allowed even when rules are created automatically
2) Be able disable / remove networks or hosts.

This automatic behavior does not buy you anything but only creates problems. If proxmox mail gateway thinks that on default local subnet should be allowed, it should add an explicit rule by default on installation, but not creating secret additional allowance rules.

 

[carsten2]

I have written a patch for this and sent it to pmg-devel:

- Bug: https://bugzilla.proxmox.com/show_bug.cgi?id=8231
- Patches on pmg-devel: https://lore.proxmox.com/pmg-devel/20261026095852.3243241-1-carsten.haerle@straightec.de/

What it changes:

1. Mail Proxy > Networks also lists the networks that PMG trusts automatically (local network, default relay, transport hosts), greyed out and with a comment where each one comes from. So the GUI finally shows what postfix actually trusts.
2. New option Mail Proxy > Options > "Trust Local Network". Default is Yes, so nothing changes unless you switch it off. If set to No, the network of the node's IP address is no longer trusted; only the default relay, the transport hosts and the networks you add explicitly may relay through port 26.
3. The default relay and transport hosts are also trusted when configured by host name. So far only IP addresses were trusted, so the same mail server could relay or not depending on how it was entered. Names are resolved when the configuration is generated, and the list shows the name an entry was resolved from.
4. Fix: adding, changing or removing a transport now updates mynetworks immediately. So far this only happened with the next full config sync.





Testing

There is a test package for installed systems with pmg-api 9.1.4 and pmg-gui 5.2.3 (other versions are refused): https://bugzilla.proxmox.com/attachment.cgi?id=2197

apt install patch
wget -O pmg-trust-local-network-test-9.1.4.tar.gz 'https://bugzilla.proxmox.com/attachment.cgi?id=2197'
tar xzf pmg-trust-local-network-test-9.1.4.tar.gz
cd pmg-trust-local-network-test
./apply.sh

Then reload the web interface (F5). apply.sh checks the versions and that the files are unmodified, saves the originals and reloads pmgdaemon and pmgproxy. ./revert.sh restores the originals, alternatively apt install --reinstall pmg-api pmg-gui.

Please note: this is an unofficial test version. An upgrade of pmg-api or pmg-gui replaces it. If you have set "Trust Local Network" to No, add the hosts that may relay to Networks and set the option back to Yes before upgrading, otherwise the original code trusts the local network again. Details are in README.txt in the package.

Feedback is very welcome, either here, on the bug or, best, as a reply on pmg-devel (a "Tested-by: Name <mail>" line helps to get it merged).