devnull's questions

We have a postfix that lives on a web server and processes mails both from the system (cron mails etc.) and the web application.

It sends mails for an own domain and a customer's domain.

Mails for owndomain.org (owndomain.org is recipient) are relayed over a relayhost that we control and that is allowed to send mails for this domain. We do this via transport_maps

The webserver is hosted by us for our customer. So it must also be able to send mails with customerdomain.org as sender. Unfortunately there is no way to make our customer change it's SPF record to include our mailserver as well. So our solution would be, to relay mails with this sender over our customer's mail server.

However, there are mails with sender (from) = customerdomain.org and recipient = owndomain.org.

Since transport_maps beats sender_dependent_relayhost_maps all mails with exactly this from/rcpt to combination would go over our own relayhost.

Is there a way to make it work as we want?

my problem is the following: When I connect from the internet to my LAN via OpenVPN, all that I can reach is the OpenVPN Server (by it's LAN IP and it's IP inside the VPN). When I add backward routes on EVERY LAN client, communication is possible. But it is tedious and not very convenient to do it for every client in my LAN. Since my VPN server does not reside on the same machine as my default gateway, I have read in various instructions, that I need to add the back-route in my gateway and everything should work fine. However, in my case it does not. I'd appreciate every input and advise how I can debug the problem. Maybe I'm missing something or is wrong configured.

My network setup:

LAN: 10.0.0.0/24

VPN: 10.4.0.0/24

• Gateway IP: 10.0.0.1 (Mini-PC with ipFire installed, Internet via modem and PPPoE)
• VPN Server IP: 10.0.0.6 (Raspberry Pi 3 running raspbian and OpenVPN)

• several other LAN clients in 10.0.0.0/24

• static route set in ipFire: Network 10.4.0.0/24 via Gateway 10.0.0.6 (without it, gateway is not be reachable via vpn)

• ip forwarding on the raspberry is enabled

• OpenVPN config: (irrelevant parts removed)

  dev tun
  port 1194
  proto udp
  mode server
  server 10.4.0.0 255.255.255.0
  push "route 10.0.0.0 255.255.255.0"
  client-to-client
  comp-lzo yes
  

• routing table on raspi (vpn server):

  Kernel IP routing table
  Destination            Gateway          Genmask         Flags Metric Ref    Use Iface
  default         ipfire.home     0.0.0.0         UG    0      0        0 eth0
  10.0.0.0        *               255.255.255.0   U     0      0        0 eth0
  10.4.0.0        10.4.0.2        255.255.255.0   UG    0      0        0 tun0
  10.4.0.2        *               255.255.255.255 UH    0      0        0 tun0
  

On an AWS EC2 instance I like to host LXC containers as kind of virtual servers. I created a bridge (br0) containing only eth0 and gave it the private ip of my VPCs subnet. I reconfigured LXC not to use lxcbr0 as bridge, but my br0 device.

When I add a new container and assign it an IP address of my VPCs subnet, I can reach the container from the lxc host. I can also reach the lxc host from within the container. But every other address can not be reached although in the same subnet.

Bridge configuration:

auto br0
iface br0 inet static

bridge_ports eth0
bridge_fd 2
bridge_stp off

address 10.8.0.11
netmask 255.255.255.0
network 10.8.0.0
broadcast 10.8.0.255
gateway 10.8.0.1
dns-nameservers 8.8.8.8 8.8.4.4

VPC NIC was set to "Disable Source/Dest. check"

ip_forwarding is set to 1

no iptables rules existent

eth0 is set to promiscuous mode (ip link set eth0 promisc on)

lxc containers are being correctly associated with my bridge

In a hardware only environment, as well as on a VirtualBox environment this setup worked. However, on AWS it does not.