Forum Discussion

JayP_46820's avatar
Icon for Nimbostratus rankNimbostratus
Jan 21, 2016

SMTP ip address for VIP and relay



Have been reading through some SMTP setups on F5 but cannot find answer to this specific question.


I have a pool of mail servers (, for VIP This is used for inbound mail from the internet, as well as mail relay from internal clients. For outbound connections there is forwarding server with SNAT of


So logical traffic flow is:


  1. Internal client wants to send external mail, it will send request to F5 VIP
  2. This is load balanced to pool member
  3. Pool member then creates new connection out to remote SMTP server
  4. This hits F5 and matches forwarding server, where it's source is translated to
  5. Remote server then replies back to, F5 checks NAT table and sends this to

Is this a valid setup?


The reason I chose the same address is I'm told forward and reverse DNS needs to match to pass mail filters. Other forum posts seems to indicate people using separate addresses, or automap?


Does the F5 will keep the entries in NAT table to distinguish between the inbound connections from clients and the outbound connections initiated to external mail servers?


I want to get this basic setup working, so I can move onto data groups to distinguish for which clients to allow relay.






3 Replies

  • I'm told forward and reverse DNS needs to match to pass mail filters


    This may be a policy set by your organization, but is not required by the technology alone. Most mail validation is handled by SPF records (a subset of the DNS type TXT record). It is common to have one or multiple IP addresses and DNS entries for inbound mail, but to use multiple separate IP addresses and DNS entries for outbound mail. With a properly configured SPF record, this can be accomplished.


    That being said, the F5 builds a new connection using many different variables. We are specifically interested in the IP and TCP information. Inbound mail will initiate from an external address bound for our VIP using a TCP SYN packet first. When the mail server sends outbound mail, it will first establish a new connection on the server, sending a new TCP SYN packet to the load balancer. The F5 interprets this as a new connection, even though it appears similar to the already existing connection. Reference the TCP 3-way handshake (link on Wikipedia) for more information on how this works.


    Is this a valid setup?


    I mostly avoided this question because I'm not sure about the SNAT pool with a member as a VIP, suffice to say I would test it to see what happens. I would trust the F5 to keep the inbound and outbound connections separate.


  • Thanks Theo, I have tested and it works fine using the same IP for the inbound VIP and for the forwarding outbound SNAT.