As Relay Client
Using a mail relay provided elsewhere might need some verification processes – it depends on how the mail relay is deployed. Some mail relays just lock the IP addresses; some might use some accounts with passwords for the other hosts to send out emails via this relay.
We use the diagram above to explain “mail relay”. When a host S wants to send emails to other mail servers B or C, for some reasons, S can not send out emails directly to B or C ( e.g., it does not have registry entry in public DNS server ); it has to place its emails to Mail Server A and let A send out those emails to B and C on behalf of it. However, Mail Server A might not let every other host send out emails via it without any verification processes. The function of this screen is to help configure the server when you want to use other hosts as mail relay.
If this machine has to act as “relay client” by using other machine as mail relay, you need to fill in some data about the mail relay you are going to use. You can use the IP address or the fully-qualified name for that host so that your machine will know which server will be used as relay. If that machine allows you to send out emails without any login or password information, you should not check the box for SMTP SASL authentication.
Usually, as a fully-qualified mail server, you should not use other machine as mail relay to send out emails. The function here is intended for the use of other modules to send out notification emails when mail server is not deployed on this machine.
Relay Control
As an email server, it is normal that people can use other mail client programs to send out emails from this email server. By default, the system will ask the client programs for login and password information in order to send out emails. (Getting emails always needs account information ). However, you can also put IP address or network address for the machine(s) to send out emails without authentication.
You can specify address like
192.168.1.3 172.16.3.0/24
in the box to allow the connection from 192.168.1.3 or 172.16.3.0/24 to send out emails without SMTP authentication.
To deploy mail server, we only recommend the following two scenarios: mail server+firewall on the same machine, and mail server behind firewall. It is not a good idea to place a mail server on the Internet without any firewall protection unless you carefully disable other network applications on that machine – but it would have some disadvantages if you have to have those network applications from your office but you do not want the outside to employ some security holes. It is a little difficult to handle this situation. Thus, we have the following two examples for your reference to deploy a mail server.
Example: Mail server and firewall on the same machine
As diagram indicated above, we have mail server and firewall together on the same machine. The firewall is to protect local network. For more details about firewall, please just refer to the corresponding section. We put this example here to bring your attention about how to deploy your mail server safely. We will elaborate “port forwarding” and other firewall features in other section. Here, we just briefly show that Email server shall be deployed with firewall together for higher security.
At first, a mail server should not with dynamic IP address on eth0. Thus, you should obtain a static IP address from your Internet service provider. Once you get a static IP address from your ISP (Internet service provider ), the ISP will provide you a list with the following information:
IP Address
Netmask
Default gateway
DNS server
Once you have the information above, you can use System->Network->Internet to put correct setting there. In that screen, hostname and domain are also there for to input. You can just put the hostname by using simple alphanumerical symbols (a-z, 0-9) and domain name. However, this is not enough. You also need to finish the mail setting by going to Email->Basic->Domain/Hostand set
Domain name: yourdomain.com
Hostname: mail.yourdomain.com
Please notice that you have to use fully-qualified hostname that can be queried from any public DNS servers. Some mail filtering programs on other mail servers would treat your emails as “junk mails” or directly drop them if the emails are not sent out from a server without the registration record in public DNS servers.
On firewall, you have to check if TCP port 25 ( for SMTP ) is open or not. You have to open TCP port 25 in order to receive emails from other places. The listing of firewall rules associating with those ports on the hosts can be found at Border Control->Advanced->Remove Rules. You can check if the following entry exists to open TCP port 25 at firewall by allowing the access outside firewall:
| Action |
Source |
Destination |
Protocol |
Destination Port |
Source port |
Original Destination IP |
| ACCEPT |
net |
fw |
tcp |
25 |
|
|
If it does not exist, you need to use Border Control->Advanced->Add rule to add this into the firewall rule. For more details, you should refer to the section for firewall for full understand how the firewall operates. And at the end of this manual, it also specifies some notes about mail server deployment.
If you want to use some email client programs ( like Outlook or Outlook Express ) on host A, B, or C, the setting on those hosts are
SMTP host: 192.168.1.1 ( the IP address of LAN interface on firewall )
POP3: 192.168.1.1
Example: Mail server inside firewall
We just ignore those domain name registration steps and assume those things are done in advance. You should have those things settled at first. Here, we directly introduce the setting the machine itself.
To deploy mail server in this network configuration, you need to use “Port forwarding” feature in the firewall. If Web mail is used, it also requires forwarding traffic arriving at firewall TCP port 8081 to that internal server and using LAN-Net loopback. For more details, you need to check the firewall section or the end of the document for deployment issues. Here, we only list the step without further explanation.
For the Mail server with 192.168.1.3, the setting on that host is as follows:
1. use System->Network->Internet to set IP address, netmask, default gateway, DNS server, host name.
But the IP address, netmask, default gateway are the setting of local network. For example, the IP address is
“192.168.1.3” – this is an IP address reserved for private use, not the list that your ISP gives to you for
setting mail server.
2. Email->Basic->Domain/Host
Domain name: yourdomain.com
Hostname: mail.yourdomain.com
When people outside the firewall, the IP address they obtain for querying “mail.yourdomain.com” shall be the IP address of eth0 of the firewall. But the SMTP traffic is being forwarded into this internal server; the “Hostname” here in email setting needs to use the fully-qualified name ( it depends on how you register the associated records in DNS ).
This mail server is protected by the firewall indicated in the diagram above.
Thus, it is not necessary to have another firewall running on the machine where mail server resides. If you have another firewall running on this mail server, turn it off or open the SMTP port.
For the firewall indicated in the diagram above, you can do as follows if you also use our firewall software on the CD:
1. System->Network->Internet
Put the static IP address along with the setting from your ISP in the following fields:
IP Address
Netmask
Default gateway
DNS server
DNS server2
2. Border Control->Basic->Port Forwarding
Border Control Forwarding Port number: 25
Protocol: TCP
Forwarding Target IP address: 192.168.1.3
If Web mail is used, you also need to forward TCP port 8081 and do “LAN-Net loopback” ( the details will be explained in firewall section or it can be found at the end of this document “deployment issues” ).
Web mail can be accessed via http://yourdomain.com/webmail/ or http://yourdomain.com:8081/webmail/ for users outside the firewall even with “LAN-Net loopback”. After that, the login will use http://yourdomain.com:8081/ for the rest of operation menus. But for users inside the firewall, it needs “LAN-Net” loopback to access web mail via URL like this.
Source Network in LAN: 192.168.1.0/24
IP of Original Destination outside: 1.2.3.4
Protocol: TCP
Port Number: 80
New Destination IP in LAN: 192.168.1.3
( for TCP port 80 loopback )
Source Network in LAN: 192.168.1.0/24
IP of Original Destination outside: 1.2.3.4
Protocol: TCP
Port Number: 8081
New Destination IP in LAN: 192.168.1.3
( for TCP port 8081 loopback )
3. In the hosts on local network, if mail client programs like Outlook or Outlook express is used, you should use
SMTP server: 192.168.1.3
POP3: 192.168.1.3 |
Input account and password to login into console configuration interface.