avggeek's questions

I have spent the last couple of days going through SO questions and the Postfix documentation but have not succeeded in figuring out what I'm doing wrong. My situation is as follows:

• I have a server running Postfix that has it's own FQDN (DomainA). Mail for DomainA is relayed through MailGun.
• The server hosts multiple website domains and the plan is to now ensure that mail for these domains is relayed through MailGun but as a separate domain. This will create separate bounce addresses etc. Call this DomainB
• Depending on which domain is present in the Header, configure Postfix to pick the appropriate SASL authentication ensuring the appropriate headers get added.

Version info: Postfix 2.11.2 on Debian 7 (Wheezy)

Output of postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_at_myorigin = no
append_dot_mydomain = no
biff = no
canonical_maps = regexp:/etc/postfix/canonical
canonical_classes = envelope_sender, header_sender
config_directory = /etc/postfix
inet_interfaces = localhost
inet_protocols = ipv4
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = localhost.com, localhost
myhostname = DomainA.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
sender_dependent_relayhost_maps = hash:/etc/postfix/relayhost_map
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sender_dependent_authentication = yes
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes

Contents of relayhost_map file:

@DomainA.com      [smtp.mailgun.org]:587
@DomainB.name     [smtp.mailgun.org]:587

Try #1 of canonical_maps- all email addresses re-written to [email protected]

/./ [email protected]

Output of mail.log when sending an email from command-line:

    Aug 18 01:55:12 DomainA postfix/pickup[3572]: C72492A00B8: uid=0 from=<root>
    Aug 18 01:55:12 DomainA postfix/cleanup[3591]: C72492A00B8: message-id=<[email protected]>
    Aug 18 01:55:12 DomainA postfix/qmgr[3573]: C72492A00B8: from=<[email protected]>, size=437, nrcpt=1 (queue active)
    Aug 18 01:55:13 DomainA postfix/smtp[3593]: C72492A00B8: to=<[email protected]>, relay=smtp.mailgun.org[50.56.21.178]:587, delay=0.28, delays=0.02/0.02/0.16/0.08, dsn=2.0.0, status=sent (250 Great success)

Email headers when received by mail client:

Delivered-To: [email protected]
Return-Path: <[email protected]>
[snip]
Sender: [email protected]
[snip]
From: Primary Root <[email protected]>
To: [email protected]
Subject: test mail #5

Two things stick out to me as being very wrong:

1. Why is Sender address set to [email protected] even though Postfix has been set as:

   append_at_myorigin = no append_dot_mydomain = no

2. Due to Sender address having DomainA.com appended to it, it seems like Postfix chose to relay mail using SASL details for DomainA - confirmed by reviewing logs on MailGun dashboard. This is causing the bounce address to be set to DomainA as well.

Try #2 of canoncial_maps- only email addresses ending with DomainB.com are re-written to [email protected]

/@DomainB.name/ [email protected]

.muttrc file setup to force From email address as DomainB.com

set from="[email protected]"
set use_from=yes
set use_envelope_from = yes

Output of mail.log:

Aug 18 03:40:49 DomainA postfix/qmgr[8809]: 2BEB92A00D3: from=<[email protected]>, size=441, nrcpt=1 (queue active)
Aug 18 03:40:49 DomainA postfix/smtp[8824]: 2BEB92A00D3: to=<[email protected]>, relay=smtp.mailgun.org[104.130.177.23]:587, delay=0.58, delays=0.01/0.02/0.37/0.17, dsn=2.0.0, status=sent (250 Great success)

Email headers when received by mail client:

Delivered-To: [email protected]
[snip]
Return-Path: <[email protected]>
[snip]
Sender: [email protected]
[snip]
From: Primary Root <[email protected]>
To: [email protected]
Subject: test mail hdr #7

3. From this test, I can see that the canonical mapping isn't the issue. The rewrite is happening correctly. However, Postfix seems to not recognize the output as a valid email address and appends the FQDN which causes the relaying to break.

Any suggestions/ideas on how to fix this are most welcome!

I have setup a Proxmox Host on OVM Hardware and am giving the guest VM's Internet access using the Bridged setup. However, as this requires editing configuration files on the Guest to work correctly, there are errors during the actual installation process resulting in issues like no interfaces files being created or resolv.conf missing.

I am trying to workaround this by adding a NAT-based interface during the Guest install. However, I am having problems where the Guest VM's can reach external servers by IP but not by name.

This is the network config on the Host:

# for Routing
auto vmbr1
iface vmbr1 inet static
    address  192.168.0.1
    netmask  255.255.255.0
    #post-up /etc/pve/kvm-networking.sh
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -F

# vmbr0: Bridging. Make sure to use only MAC adresses that were assigned to you.
auto vmbr0
iface vmbr0 inet static
    address 192.99.36.XXX
    netmask 255.255.255.0
    network 192.99.36.0
    broadcast 192.99.36.255
    gateway 192.99.36.254
    bridge_ports eth0
    bridge_stp off
    bridge_fd 0
    post-up echo 1 > /proc/sys/net/ipv4/conf/vmbr0/forwarding
    post-up echo 1 > /proc/sys/net/ipv4/conf/vmbr0/proxy_arp

I have also enabled IP Forwarding & ARP Proxy on the Host:

# cat /proc/sys/net/ipv4/ip_forward                               
1
# cat /proc/sys/net/ipv4/conf/all/proxy_arp                       
1

In trying to get the DNS working, I have added a number of rules to iptables. Here's the iptables output from the Host machine:

Chain INPUT (policy ACCEPT 5344 packets, 2016K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.0.0/24       udp spt:53 dpts:1024:65535 state ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.0/24       tcp spt:53 dpts:1024:65535 state ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:53 state NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:53 state NEW,ESTABLISHED

Chain OUTPUT (policy ACCEPT 5141 packets, 2302K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp spts:1024:65535 dpt:53 state NEW,ESTABLISHED

Chain PREROUTING (policy ACCEPT 60270 packets, 7555K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 53578 packets, 11M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   420 MASQUERADE  all  --  *      vmbr0   192.168.0.0/24       0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 53578 packets, 11M bytes)
 pkts bytes target     prot opt in     out     source               destination

Once I boot up the Guest VM, here's the output of ping/nslookup in the Guest:

This is the ifconfig output for the Guest:

The output of tcpdump at the Guest level when running nslookup looks like this:

Output of tcpdump at the Host level is fairly similar, but I'm including it for reference anyway:

# tcpdump -n -tttt -i vmbr1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vmbr1, link-type EN10MB (Ethernet), capture size 65535 bytes
2014-04-20 08:38:48.013775 ARP, Request who-has 192.168.0.1 tell 192.168.0.101, length 28
2014-04-20 08:38:48.013796 ARP, Reply 192.168.0.1 is-at 56:6a:38:7c:1b:0a, length 28
2014-04-20 08:38:48.013860 IP 192.168.0.101.41572 > 192.168.0.1.53: 54954+ A? google.com. (28)
2014-04-20 08:38:48.013884 IP 192.168.0.1 > 192.168.0.101: ICMP 192.168.0.1 udp port 53 unreachable, length 64
2014-04-20 08:38:53.013443 ARP, Request who-has 192.168.0.101 tell 192.168.0.1, length 28
2014-04-20 08:38:53.013594 ARP, Reply 192.168.0.101 is-at de:0a:bd:d1:82:19, length 28
2014-04-20 08:38:53.013676 IP 192.168.0.101.41572 > 192.168.0.1.53: 54954+ A? google.com. (28)
2014-04-20 08:38:53.013701 IP 192.168.0.1 > 192.168.0.101: ICMP 192.168.0.1 udp port 53 unreachable, length 64
2014-04-20 08:38:56.810432 IP 0.0.0.0 > 224.0.0.1: igmp query v2
2014-04-20 08:38:56.810433 IP6 23dc:26d9:f488:a50d:100:: > ff02::1: HBH ICMP6, multicast listener querymax resp delay: 1000 addr: ::, length 24
2014-04-20 08:38:58.013733 IP 192.168.0.101.41572 > 192.168.0.1.53: 54954+ A? google.com. (28)
2014-04-20 08:38:58.013758 IP 192.168.0.1 > 192.168.0.101: ICMP 192.168.0.1 udp port 53 unreachable, length 64
^C
12 packets captured
12 packets received by filter
0 packets dropped by kernel

If anyone can tell me what I'm doing wrong and how to fix it, I'd really appreciate it!