[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: exim & iptables


On Monday, March 10, 2003, at 02:48 AM, Vineet Kumar wrote:


* Hal Klingsporn <hal@retrotech.org> [20030309 06:26 PST]:


On Saturday, March 8, 2003, at 09:58 PM, Gary Turner wrote:


Hal wrote:
I'm using Woody as a firewall with NAT to protect a small network that 
includes a mail and web server on  an unregistered (192.168....)
network. I'd like to configure the fw so that it can send mail alerts 
to the users via the mail server on the protected net.  If I set
exim.conf to preclude all local machine delivery (i.e. force remote
delivery)


Why would you do that?  How do your local (intranet) users get their
mail?
Mail to/from users on the local net are handled by a mail (exim) server 
inside the firewall.  This works very well.  The only issue is getting
machine generated mail from the fw to the internal mail server.
Disabling local delivery (local to the firewall) forces exim on the
firewall to look for the appropriate mail server.



Any suggestions on how to tell the firewall to send mail to the
internal mail server?  Is it an exim or firewall config issue?


Well, both, I think.

I'd recommend you use a strictly internal domain (i.e. .internal or
.lan, not .myinternetname.com) for your internal hosts.  Then, set your
firewall to use this internal domain as its qualify_domain, and it
should know that the default mail server for that internal domain is the 
internal name of your internal mail server.  Make sense?
Yes, I can see how that could work, but there "ought to be" a way to route the fw's mail without renaming all the machines on the internal LAN. And, I do want the alert mail from the fw to appears in the mail stream that I regularly read. I'll have to think it through better. 


good times,
Vineet
--
http://www.doorstop.net/
--
#include<stdio.h>
int main() {
    puts("Reader! Think not that \n"
         "technical information \n"
         "ought not be called speech;");
    return 0;
}
<signature.asc>
Reply to: