differentiate between "allow to deliver to local addresses" and "allow relay"

[masterx]

Hi

I have transitioned to PMG in my semi-production home-lab environment a few weeks ago and I do like the product very much so far.
However one thing still bothers me a bit. In the previous product i was using, it was possible to allow local mail delivery (i.e. delivery to domains which the mail gateway is "responsible" for) from internal servers (like backup report mails, monitorin alerts, and so forth) without having to allow these servers relaying mails to outside recipients.

I did like this as kind of an additional security measure so that if one of the servers gets hacked (some of them are accessible from the internet), they can't be used as open relays because mailing is only possible to "internal" mail domains. In PMG I have to add an internal server to the whitelist or send via the internal port (26) but if I do this, the server is allowed to send to any recipient in the world.

I hope it is clear what I would like to see and if it is currently not possible, please look at this as a feature request

Thanks!

 

[Stoiko Ivanov]

Not sure if I get the complete use case - but have you tried the following?:

* create a rule with appropriate priority and direction outbound
* create a who-object containing all IPs (or the networks) of your internal servers
* create a who-object containing your internal domains (where the internal servers may send mails to)
* set the first object as from on the rule, the second one as to
* add the action ACCEPT

* create a second rule with lower priority (one less than the previous rule)
* set the who object with your IPs as from
* set the object to BLOCK/Quarantine

Would that work?

 

[masterx]

Interesting approach, will definitely try that out. I didn't think of configuring rules because without whitelisting my "internal" "system-mails" got filtered already just because of the fact that they didn't pass the SPF check, obviously.

 

[Stoiko Ivanov]

already just because of the fact that they didn't pass the SPF check, obviously.

if you've enabled SPF checking in the mail proxy (GUI -> Configuration -> Mail Proxy ->Options) and your have a hard reject in your spf policy ('-all') then you either need to provide a changed SPF record in your internal DNS or add the server to the Mail Proxy Whitelist ( GUI -> Configuration -> Mail Proxy -> Whitelist)

I hope this helps!