Mailgateway as extra filter

[scornelissen]

Hello,

Currently we have a mailserver running. Is it possible to use PMG as an extra layer of filtering whereby our mailserver still does the filtering and Proxmox Mail Gateway adds extra filtering we would apply? And how do I need to deploy this? I thought this would work:

Internet --> <ext-ip> Firewall <internal-ip> --> Proxmox Mail Gateway <internal-ip> --> <internal-ip> Internal mailserver

Whereby PMG and the internal mailserver would apply both spam filtering, but when I PMG send the mail to the internal mailserver, this one handles it as internal traffic and bypasses spam filtering. If I use and external IP-address to forward mail from PMG to our internal mailserver, then SPF would fail in the internal mailserver.

Is this supposed to work?

 

[Stoiko Ivanov]

Currently we have a mailserver running. Is it possible to use PMG as an extra layer of filtering whereby our mailserver still does the filtering and Proxmox Mail Gateway adds extra filtering we would apply?

This is usually the way PMG is deployed (and it should not matter if the downstream server (Internal mailserver) does additional filtering)

Whereby PMG and the internal mailserver would apply both spam filtering, but when I PMG send the mail to the internal mailserver, this one handles it as internal traffic and bypasses spam filtering.

This can usually be configured on the internal mail server (add PMG as trusted relay - but that depends on the mail software running on the internal server)

If I use and external IP-address to forward mail from PMG to our internal mailserver, then SPF would fail in the internal mailserver.

yes it would - we recommend to either disable SPF checking on the internal mail-server - or at least accept mail from PMG without considering SPF

I'd suggest you just try it out (setting up PMG is a matter of a few minutes) and as long as you don't point your MX records to PMG it should not be in the way of your mail-flow

Check out the reference documentation on the topic:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_deployment

I hope this helps!

 

[treloskilo]

It works like this

Internet-> Firewall->Proxmox Mail Gateway->Exchange

 

[scornelissen]

This is usually the way PMG is deployed (and it should not matter if the downstream server (Internal mailserver) does additional filtering)


This can usually be configured on the internal mail server (add PMG as trusted relay - but that depends on the mail software running on the internal server)


yes it would - we recommend to either disable SPF checking on the internal mail-server - or at least accept mail from PMG without considering SPF

I'd suggest you just try it out (setting up PMG is a matter of a few minutes) and as long as you don't point your MX records to PMG it should not be in the way of your mail-flow

Check out the reference documentation on the topic:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_deployment

I hope this helps!

Our mailserver has the only ability to set an internal IPv4 range as trusted network. PMG is in this trusted network and such our mailserver applies no filter anymore. The "solution" I have (and that seems to work) is dat PMG send the mail to our mailserver via an external IP-address. Then our internal mailserver handles it as "untrusted" and does the scanning. It's not very nice, but for our mailserver this looks the working solution. Even if I set PMG outside of our current IPv4 block, it still passes the filtering as it states that internal IP-addresses will bypass spam filtering.

Internet <external-ip> -> Firewall <internal-ip> -> PMG -> Firewall <external-ip> -> Firewall <internal-ip> -> mailserver

I then have to disable the SPF checking on our internal mailserver. But one of the nice things in our current mailserver is that we can increase a spam score if the SPF check failed. In PMG it's quite hard blocking if SPF fails?

 

[hata_ph]

I then have to disable the SPF checking on our internal mailserver. But one of the nice things in our current mailserver is that we can increase a spam score if the SPF check failed. In PMG it's quite hard blocking if SPF fails?

You can set custom SPF_FAIL score under Configuration -> Spam Detector -> Custom Scores.

 

[scornelissen]

You can set custom SPF_FAIL score under Configuration -> Spam Detector -> Custom Scores.

Thanks, I will try that