<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
Glenn Steen wrote:
<blockquote cite="mid223f97700602130145qcd13bedx@mail.gmail.com"
type="cite">
<pre wrap="">On 13/02/06, Philipp Snizek <a class="moz-txt-link-rfc2396E" href="mailto:philipp.snizek@terreactive.ch"><philipp.snizek@terreactive.ch></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">c) use a transparent smtpd service
</pre>
</blockquote>
<pre wrap=""><!---->Any modern firewall can do port forwarding with only "filtering", that
is _no "stateful inspection" or suchlike intervention_.
When we introduced Postfix&MailScanner as our "frontend MTA", that was
mainly to get out of the bugginess and instability of the infamous
SMTP proxy of the firewall we used at the time... (Yours wouldn't
happen to be ... red?:-):-) We haven't looked back since. We get
better protection and more control... And (due to both the public
firewall and the on-box FW) we are confident there is no possibility
of ... "traffic leakage".
I suppose what I'm advocating is some variant of c).
</pre>
</blockquote>
<rant><br>
You *shouldn't* have to use any form of smtpd on the firewall. Check
the firewall mailing lists; a firewall is a firewall is a firewall, not
a server. It shouldn't be running any services. It should simply
forward traffic transparently to your MS gateway.<br>
<br>
I have had a ton of problems with some boxes (I'm almost sure they
were, in fact, red) wanting to proxy the mail. They either keep it to
themselves and not tell anybody, crash and take the e-mails with them,
prevent me from using RBL's at the MTA level (all e-mail appears to
come from the box), process e-mail from shotgun spammers (something I
deal with using greet_pause), prevent people from using SMTP AUTH
properly, ... the list goes on.<br>
<br>
In fact, I remember a *bank* whose fancy schmancy (and red, now that
you mention it) box broke once... The "red box guy" they had wasn't
available, so they called me to see if there was something I could do.
I enabled the second interface on the server, installed a custom
firewall script + dhcp + dns (forward and reverse) + transparent squid
+ squidclamav, and within the hour everybody was back to normal...
except for the fact that network throughput was somehow faster, we had
full logging of everything we wanted to know about the network and how
it was being used, etc. - you guys *know* what I'm talking about here.<br>
<br>
Unfortunately, the "red box guy" came about 4 hours later and restored
insanity to the place; people still talk about those glorious 3 hours
where "the network was fast, e-mail came through instantaneously, and
people loved one another". The second interface on the server sits
waiting for the day where the sysadmin will finally be able to work up
the guts to sell the shiny red box on eBay (for at least the "books"
value, so he can justify it) and finally have complete control of his
network.<br>
<br>
</rant><br>
<pre class="moz-signature" cols="72">--
Alex Neuman van der Hans
N&K Technology Consultants
Tel. +507 214-9002 - <a class="moz-txt-link-freetext" href="http://nkpanama.com/">http://nkpanama.com/</a></pre>
</body>
</html>