Greetings all,
I stumbled upon the Proxmox mail gateway a couple of days ago when researching a replacement for VMware. We have a hybrid exchange setup. This means that most of our email function is in Exchange Online while the on premise server just functions as a relay for all devices on premise.
The problem is that we do not need an Exchange server on site to do this simple relaying. We looked at the SMTP server for windows, but that has been discontinued. So we were on the lookout for a third party solution. This solution would need to relay the emails to Exchange online securely (encrypted via TLS). We also have complex routing rules (send connectors) for certain domains email is sent to.
I am so glad to see that Proxmox mail Gateway 9.1.0 does all this! The setup was fairly easy, but had to use AI to answer a few problems. I found that some settings had to be done in the CLI and not the GUI. Only a couple, most everything else was set in the GUI.
On top of that, the reporting, alerting, and logging seem expectable.
I just want to put on paper what I had to do to get all this working.
Most of the settings were in the Mail Proxy section.
Relaying
Set the "Default Relay" and "Smarthost" to our exchange online. (xxx.mail.protection.outlook.com)
Relay Domains
We have two domains that we have, so I set them here.
Options
I kept "verify Receivers" set to "No"
"Use greylisting for IPV4" set to "No"
"Log Header Information" set to "Yes"
Transports
We have a couple of domains that routed on premise to different hosts. One of the hosts is our fax server. Any email send to @fax.co is redirected here to the host address listed. Since I am using this transport, I had to set the Smarthost under relaying.
Networks
This is who is allowed to connect to the mail gateway and send emails out. Here I have the servers and printers (use CIDR IE, 192.168.0.1/24 [whole subnet] or 192.168.1.10/32 for a single host]
TLS
Settings
Enable TLS set to "Yes"
Enable TLS logging set to "Yes"
Add TLS received header set to "Yes"
One of these steps created a self-signed certificated to be used with TLS. I thought for sure I would had to use a purchased cert or use ACME, but it just worked. I do have our public IP addresses whitlisted with Entra, so maybe that is the reason.
TLS Destination Policy
I added my domain for faxes here
Destination = fax.co Policy=none
(I had to create a policy to not encrypt emails to the fax server. By default, the mail gateway sends email unencrypted. We needed all mail outbound to Exchange online to be encrypted....So all domains would need to be encrypted. There was no way to do this in the GUi, so I had to run these commands to make the server always send with TLS.
1. Create the template directories if they do not exist:
bash
mkdir -p /etc/pmg/templates
2. Append the literal * wildcard and force TLS encryption rules straight into the PMG policy map:
bash
echo "* encrypt" >> /etc/pmg/tls_policy
3. Compile the plain-text policy table into a binary .db hash map that Postfix reads natively:
bash
postmap /etc/pmg/tls_policy
4. Tell Proxmox Mail Gateway to sync its configuration matrix and safely kick the mail engine:
bash
pmgconfig sync --restart 1
Welcomelist
I added our domain here so that nothing would be scanned for spam and viruses. Exchange Online can handle this.
Devices on the network that sends emails to the mail gateway will need to use port 26. This will ensure that the rules are used.
Hopefully some finds this useful.
Again, thanks to Proxmox for a decent program. I am not using near what it is capable of, but I needed something with a GUI for our administrators to use with ease. Now I can say we have a Proxmox product in production here.
I stumbled upon the Proxmox mail gateway a couple of days ago when researching a replacement for VMware. We have a hybrid exchange setup. This means that most of our email function is in Exchange Online while the on premise server just functions as a relay for all devices on premise.
The problem is that we do not need an Exchange server on site to do this simple relaying. We looked at the SMTP server for windows, but that has been discontinued. So we were on the lookout for a third party solution. This solution would need to relay the emails to Exchange online securely (encrypted via TLS). We also have complex routing rules (send connectors) for certain domains email is sent to.
I am so glad to see that Proxmox mail Gateway 9.1.0 does all this! The setup was fairly easy, but had to use AI to answer a few problems. I found that some settings had to be done in the CLI and not the GUI. Only a couple, most everything else was set in the GUI.
On top of that, the reporting, alerting, and logging seem expectable.
I just want to put on paper what I had to do to get all this working.
Most of the settings were in the Mail Proxy section.
Relaying
Set the "Default Relay" and "Smarthost" to our exchange online. (xxx.mail.protection.outlook.com)
Relay Domains
We have two domains that we have, so I set them here.
Options
I kept "verify Receivers" set to "No"
"Use greylisting for IPV4" set to "No"
"Log Header Information" set to "Yes"
Transports
We have a couple of domains that routed on premise to different hosts. One of the hosts is our fax server. Any email send to @fax.co is redirected here to the host address listed. Since I am using this transport, I had to set the Smarthost under relaying.
Networks
This is who is allowed to connect to the mail gateway and send emails out. Here I have the servers and printers (use CIDR IE, 192.168.0.1/24 [whole subnet] or 192.168.1.10/32 for a single host]
TLS
Settings
Enable TLS set to "Yes"
Enable TLS logging set to "Yes"
Add TLS received header set to "Yes"
One of these steps created a self-signed certificated to be used with TLS. I thought for sure I would had to use a purchased cert or use ACME, but it just worked. I do have our public IP addresses whitlisted with Entra, so maybe that is the reason.
TLS Destination Policy
I added my domain for faxes here
Destination = fax.co Policy=none
(I had to create a policy to not encrypt emails to the fax server. By default, the mail gateway sends email unencrypted. We needed all mail outbound to Exchange online to be encrypted....So all domains would need to be encrypted. There was no way to do this in the GUi, so I had to run these commands to make the server always send with TLS.
1. Create the template directories if they do not exist:
bash
mkdir -p /etc/pmg/templates
2. Append the literal * wildcard and force TLS encryption rules straight into the PMG policy map:
bash
echo "* encrypt" >> /etc/pmg/tls_policy
3. Compile the plain-text policy table into a binary .db hash map that Postfix reads natively:
bash
postmap /etc/pmg/tls_policy
4. Tell Proxmox Mail Gateway to sync its configuration matrix and safely kick the mail engine:
bash
pmgconfig sync --restart 1
Welcomelist
I added our domain here so that nothing would be scanned for spam and viruses. Exchange Online can handle this.
Devices on the network that sends emails to the mail gateway will need to use port 26. This will ensure that the rules are used.
Hopefully some finds this useful.
Again, thanks to Proxmox for a decent program. I am not using near what it is capable of, but I needed something with a GUI for our administrators to use with ease. Now I can say we have a Proxmox product in production here.