The FreeBSD Diary

My ISP started blocking incoming port 25. It's already blocking outgoing port 25 and I'm handling that. Now it's time to start accepting incoming mail on the submission port, 587. They aren't blocking my incoming port 25. But we went through this process for another guy on our computer, so I figured that this is a good thing for which it will pay to be pro active.

This solution assumes you have a mail server at home and at least one other mail server out there on the Internet, one which does not have port 25 blocked. That part is crucial to this solution. It is the external server[s] that will accept incoming mail and forward it to you. In DNS terms, your MX records will not point to your home server, but to your public server.

I started by adding the following line to /usr/local/etc/postfix/master.cf on my Postfix mail server at home:

10.34.0.1:587 inet n - n - - smtpd

$ grep 587 /etc/services
submission      587/tcp
submission      587/udp

Then I added this to /usr/local/etc/postfix/main.cf on my public mail server:

transport_maps = hash:/usr/local/etc/postfix-config/transport

This tells Postfix to observe the transport directives in the above mentioned file. You can put the file whereever you want. I like to keep it in that directory, which you'll probably have to create because it's not part of the standard system. In /usr/local/etc/postfix-config/transport I have:

myserver.example.org    smtp:[myserver.example.org]:587

Where myserver.example.org is the hostname of my mail server at home. You need to create a .db file to go with that. I issued these commands:

cd /usr/local/etc/postfix-config
postmap transport

You should now see a transport.db file. After making these changes you should restart postfix:

postix restart

Then I sent a test message from the public mail server

$ echo 'test' | mail me@myserver.example.org

I confirmed that it was coming in on port 587 with this command on my mail server at home:

tcpdump -i fxp0 port 587

Where fxp0 is the outside NIC on my firewall (the one with IP 10.34.0.1) as shown above.

Then, on the public mail server, I requeued all the messages, so they'd use the right transport:

postsuper -r ALL

It's magic!

All the messages were delivered to the right spot.

I control access to port 587 on my mail server. I have firewall rules in place that allow connections only from my home server. I think there are no security risks involved in keeping it open, but I see no reason to give access where no access is required.

If you need to handle outgoing port 25 to avoid ISP blocks, you can always the same instructions, but in the reverse direction. It should just work.