Mailgateway as extra filter

Jan 8, 2018
8
0
21
36
Hello,

Currently we have a mailserver running. Is it possible to use PMG as an extra layer of filtering whereby our mailserver still does the filtering and Proxmox Mail Gateway adds extra filtering we would apply? And how do I need to deploy this? I thought this would work:

Code:
Internet --> <ext-ip> Firewall <internal-ip> --> Proxmox Mail Gateway <internal-ip> --> <internal-ip> Internal mailserver

Whereby PMG and the internal mailserver would apply both spam filtering, but when I PMG send the mail to the internal mailserver, this one handles it as internal traffic and bypasses spam filtering. If I use and external IP-address to forward mail from PMG to our internal mailserver, then SPF would fail in the internal mailserver.

Is this supposed to work?
 
Last edited:

Stoiko Ivanov

Proxmox Staff Member
Staff member
May 2, 2018
6,683
992
163
Currently we have a mailserver running. Is it possible to use PMG as an extra layer of filtering whereby our mailserver still does the filtering and Proxmox Mail Gateway adds extra filtering we would apply?
This is usually the way PMG is deployed (and it should not matter if the downstream server (Internal mailserver) does additional filtering)

Whereby PMG and the internal mailserver would apply both spam filtering, but when I PMG send the mail to the internal mailserver, this one handles it as internal traffic and bypasses spam filtering.
This can usually be configured on the internal mail server (add PMG as trusted relay - but that depends on the mail software running on the internal server)

If I use and external IP-address to forward mail from PMG to our internal mailserver, then SPF would fail in the internal mailserver.
yes it would - we recommend to either disable SPF checking on the internal mail-server - or at least accept mail from PMG without considering SPF

I'd suggest you just try it out (setting up PMG is a matter of a few minutes) and as long as you don't point your MX records to PMG it should not be in the way of your mail-flow

Check out the reference documentation on the topic:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_deployment

I hope this helps!
 
Jan 8, 2018
8
0
21
36
This is usually the way PMG is deployed (and it should not matter if the downstream server (Internal mailserver) does additional filtering)


This can usually be configured on the internal mail server (add PMG as trusted relay - but that depends on the mail software running on the internal server)


yes it would - we recommend to either disable SPF checking on the internal mail-server - or at least accept mail from PMG without considering SPF

I'd suggest you just try it out (setting up PMG is a matter of a few minutes) and as long as you don't point your MX records to PMG it should not be in the way of your mail-flow

Check out the reference documentation on the topic:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_deployment

I hope this helps!
Our mailserver has the only ability to set an internal IPv4 range as trusted network. PMG is in this trusted network and such our mailserver applies no filter anymore. The "solution" I have (and that seems to work) is dat PMG send the mail to our mailserver via an external IP-address. Then our internal mailserver handles it as "untrusted" and does the scanning. It's not very nice, but for our mailserver this looks the working solution. Even if I set PMG outside of our current IPv4 block, it still passes the filtering as it states that internal IP-addresses will bypass spam filtering.

Code:
Internet <external-ip> -> Firewall <internal-ip> -> PMG -> Firewall <external-ip> -> Firewall <internal-ip> -> mailserver

I then have to disable the SPF checking on our internal mailserver. But one of the nice things in our current mailserver is that we can increase a spam score if the SPF check failed. In PMG it's quite hard blocking if SPF fails?
 
Last edited:

hata_ph

Well-Known Member
Nov 13, 2019
749
157
48
42
I then have to disable the SPF checking on our internal mailserver. But one of the nice things in our current mailserver is that we can increase a spam score if the SPF check failed. In PMG it's quite hard blocking if SPF fails?
You can set custom SPF_FAIL score under Configuration -> Spam Detector -> Custom Scores.
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!