Routing question?

[Kurt Buff]

Dan Nelson wrote:
> In the last episode (Apr 13), Kurt Buff said:
> 
>>I have a FreeBSD 5.3 box running
>>postfix/amavisd-new/spamassassin/clamav. Currently, we have two
>>entrances to our network, one is the Watchguard FBIII for our T1, the
>>other is a PC running Win2k and Winproxy, serving our DSL line. The
>>PC is starting to flake out, and I'd like to replace it with a
>>Wachguard SOHO that we have laying around.
> 
> 
> It might be easier to just hang your DSL line off your External or
> Optional network, so you can enable the FBIII's SMTP filtering on both
> your DSL and T1 lines.  Hanging it off a SOHO in your Trusted network
> is a bit less secure (but no worse than your winproxy setup).

That's worthy of some thought. It may not fulfill the layer 8 
requirements, however.

>>The default gateway for the FreeBSD box is pointed at the WG FBIII,
>>as that's the way most of our email comes through.
>>
>>What the PC with Winproxy does is accept inbound email connections to
>>our secondary MX, and presents them to the FreeBSD box. I'm assuming
>>that the Winproxy program was doing something funky to make all of
>>this happen, but I'm really set on replacing it. This has been
>>working for a year or two, but lately the Winproxy program on the PC
>>is falling over several times a day. It's not a hardware error - all
>>other programs on the machine work just fine, but Winproxy is dieing.
>>
>>When I hook up the SOHO, I can't get emails through the DSL line.
> 
> 
> What fails?  Do you get connection refused?  Maybe you just need to
> open port 25 incoming on the SOHO and redirect it to the FreeBSD box's
> IP (set up an alias IP in the SOHO's default 192.168.111/24 network if
> you can't get the SOHO to use your exisitng Trusted network as its
> trusted network).
> 
> I have a Firebox 1000 and a SOHO at work but don't have the SOHO's
> password on me so I can't tell you exactly what to set where :)

Failure mode is that when I telnet to the external IP address of the 
soho on port 25, I get no answer. On the SOHO, I have port 25 set to 
allow inbound access, only to the IP address of the postfix box. It 
smells to me like what's happening is that the inbound packets are 
making it to and through the SOHO, but then the postfix box obeys its DG 
setting, and tries to send the responses out the FBIII, and they never 
make it back to the originating box.

Kurt