Routing question?

Dan Nelson dnelson at
Thu Apr 14 11:59:19 PDT 2005

In the last episode (Apr 14), Kurt Buff said:
> Dan Nelson wrote:
> >In the last episode (Apr 13), Kurt Buff said:
> >>I have a FreeBSD 5.3 box running
> >>postfix/amavisd-new/spamassassin/clamav. Currently, we have two
> >>entrances to our network, one is the Watchguard FBIII for our T1,
> >>the other is a PC running Win2k and Winproxy, serving our DSL line.
> >>The PC is starting to flake out, and I'd like to replace it with a
> >>Wachguard SOHO that we have laying around.
> >> 
> >>The default gateway for the FreeBSD box is pointed at the WG FBIII,
> >>as that's the way most of our email comes through.
> >>
> >>What the PC with Winproxy does is accept inbound email connections
> >>to our secondary MX, and presents them to the FreeBSD box. I'm
> >>assuming that the Winproxy program was doing something funky to
> >>make all of this happen, but I'm really set on replacing it. This
> >>has been working for a year or two, but lately the Winproxy program
> >>on the PC is falling over several times a day. It's not a hardware
> >>error - all other programs on the machine work just fine, but
> >>Winproxy is dieing.
> >>
> >>When I hook up the SOHO, I can't get emails through the DSL line.
> Failure mode is that when I telnet to the external IP address of the
> soho on port 25, I get no answer. On the SOHO, I have port 25 set to
> allow inbound access, only to the IP address of the postfix box. It
> smells to me like what's happening is that the inbound packets are
> making it to and through the SOHO, but then the postfix box obeys its
> DG setting, and tries to send the responses out the FBIII, and they
> never make it back to the originating box.

That's possible, since the FBIII won't allow those outgoing packets
without having seen the full TCP handshake.

You could use ipfw fwd rules to force the outgoing packets to route via
the SOHO:

               ( Internet )  FBIII         SOHO   (external)
              |            | (internal)
              |            |

The BSD machine would have three IPs:  (, primary incoming mail)  (, outgoing mail) (secondary incoming mail) would be set to and the SOHO would be told to
forward port 25 to  If you add this ipfw rule to BSD:

    fwd ip from to any

, that should be enough to force all (and only) the DSL mail traffic
through the SOHO.
	Dan Nelson
	dnelson at

More information about the freebsd-questions mailing list