Forum Discussion
ajafari_2524
Nimbostratus
NimbostratusPublishing private IP in Email Header After PAT
Kindly note that we have and F5 implementation as part of a third party solution which we are having problem with.
The issue is that the F5 node is doing PAT on internal IP addresses when forwarding message to external servers using the Public IP address. Our requirement is that in case of email communication , we are trying to show the private IP address within the message header in addition to the public IP address.
A feature on F5 called (x-forwarded) has been tried for this matter with no luck . Kindly advise on:
Confirm if (x-forwarded) would really help in this case
Advise on how (x-forwarded) feature is used with PAT on F5.
THANKS!!
7 Replies
HamishCirrocumulus
X-Forwarded-For is really for HTTP, although there's not alot to stop you from using it in SMTP as well. It'll get igniored as it's an X- header.
However a more standard looking way would be to insert a fake received-from header into the SMTP headers so that the BigIP looks like an SMTP hop (i.e. Has both the realIP in one received line and the translated address will be inserted into the next one by the next hop).
H
ajafari_2524to insert a fake received-from header into the SMTP headers so that the BigIP looks like an SMTP hop
Thanks for the tip hamish, however I am not sure where should this inseration happen? I mean should it be on the client side or at the Big IP side? and how?
Thanks again
AJ- HamishWell... I can think of a couple of approaches.
1. You could write an iRule to parse through the SMTP headers and add a new Received-From header after the last one. That'd be themost flexible, but would
2. If the previous Received-From is fairly static (Or a limited number of entries) you could add a new one (Or even alter the existing one) via a stream profile.
H - ajafari_2524Hmm interseting !
I wonder if High Speed Logging orusing SMTP proxy iRule be helpful in this? 
What_Lies_Bene1Cirrostratus
Two things;
1) Some might consider inserting this information a security risk, as you are revealing your internal addressing externally.
2) I'm not sure what logging has to do with your issue?- ajafari_2524Thanks WLB for your queries, to answer:
1. It is a requirement to log user behaviour in case we got complaint from outside our company. Can u suggest a better option that is less of a security risk?
2. HSL can be used to log the information from source IP and pass it in the SMTP header of the PAT traffic (or actually I am hoping if someone can tell me it can) - What_Lies_Bene11.) Perhaps you could just insert the last, or last two octets of the IP address? Would that be enough to identify the source? Or perhaps a hostname, it's still revealing but not quite as bad.
2.) HSL is for logging, you can't use it to to insert SMTP headers. But you could use it to log details about every message sent, would that be useful to you?
