Sending original IP (proxy) for smtp
I’d like stunnel to pass the incoming IP along, not stunnel's IP. My traffic flow is: Stunnel (accept on port 465) -> ASSP (an smtp proxy) -> Postfix (accept on port 10026) I tried: [ssmtp] client = no accept = 465 connect = 25 protocol = proxy But ASSP had: Apr-15-19 18:50:22 [Worker_1] Connected: session:7FE104AA1870 127.0.0.1:58954 > 127.0.0.1:25 > 127.0.0.1:10026 Apr-15-19 18:50:23 [Worker_1] 127.0.0.1 warning: got reply '502 5.5.2 Error: command not recognized' from 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 info: sending EHLO instead of HELO to 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 disconnected: session:7FE104AA1870 127.0.0.1 - processing time 1 seconds And Postfix had: 2019-04-15 18:50:22.995042+1000 localhost smtpd[33360]: connect from localhost[127.0.0.1] 2019-04-15 18:50:23.108756+1000 localhost smtpd[33360]: improper command pipelining after EHLO from localhost[127.0.0.1]: RSET\r\n 2019-04-15 18:50:23.273664+1000 localhost smtpd[33360]: disconnect from localhost[127.0.0.1] ehlo=2 rset=1 quit=1 unknown=0/1 commands=4/5 So I take it protocol=proxy is not the way to do it. Sounds like this only works with haproxy which I do not have installed. Is there a way to do this? The problem I am trying to solve is ASSP has lines like: warning: SMTP authentication failed on 127.0.0.1 - obviously I don’t want fail2ban to ban 127.0.0.1. Stunnel log has: 2019.04.15 18:52:26 LOG5[23]: Service [ssmtp] accepted connection from ::ffff:185.222.209.66:53642 2019.04.15 18:52:27 LOG3[23]: s_connect: connect ::1:25: Connection refused (61) Any suggestions? Thanks, James.
On Tue, Apr 16, 2019 at 03:52:15PM +1000, James Brown wrote:
I’d like stunnel to pass the incoming IP along, not stunnel's IP.
Hi, If this is a Linux or FreeBSD system, you may want to try the transparent proxy support; take a look at the "transparent" option in the stunnel documentation. G'luck, Peter -- Peter Pentchev roam@{ringlet.net,debian.org,FreeBSD.org} [email protected] PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13
On 16 Apr 2019, at 5:14 pm, Peter Pentchev <[email protected]> wrote:
On Tue, Apr 16, 2019 at 03:52:15PM +1000, James Brown wrote:
I’d like stunnel to pass the incoming IP along, not stunnel's IP.
Hi,
If this is a Linux or FreeBSD system, you may want to try the transparent proxy support; take a look at the "transparent" option in the stunnel documentation.
G'luck, Peter
Thanks Peter, that looks like just what I need. Unfortunately: LOG3[1]: Transparent proxy in remote mode is not supported on this platform I used transparent=source Running macOS X Mojave. Based on FreeBSB, but diverging more and more. :-( James.
On Tue, Apr 16, 2019 at 05:24:12PM +1000, James Brown wrote:
On 16 Apr 2019, at 5:14 pm, Peter Pentchev <[email protected]> wrote:
On Tue, Apr 16, 2019 at 03:52:15PM +1000, James Brown wrote:
I’d like stunnel to pass the incoming IP along, not stunnel's IP.
Hi,
If this is a Linux or FreeBSD system, you may want to try the transparent proxy support; take a look at the "transparent" option in the stunnel documentation.
G'luck, Peter
Thanks Peter, that looks like just what I need. Unfortunately:
LOG3[1]: Transparent proxy in remote mode is not supported on this platform
I used transparent=source
Running macOS X Mojave. Based on FreeBSB, but diverging more and more.
:-(
Actually it has had a completely different kernel from the start, and the transparent proxy support depends partly on kernel support, so, yeah, sorry, no luck :/ G'luck, Peter -- Peter Pentchev roam@{ringlet.net,debian.org,FreeBSD.org} [email protected] PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13
participants (2)
-
James Brown -
Peter Pentchev