I am trying to load balance SMTP but the server guys need to see the original source IP in order to allow or deny sending emails.
The problem is that I need to work with SNAT because the backend servers are far from the LB, behind another firewall and router. Their default gateway must be the one of the router.
If I keep the original source IPs, I would face asymmetric routing and the some firewall on the way back would kill the session.
We checked the backend SMTP server configuration and there is no other way to allow/deny sources there except of the IP addresses.
So can I load balance SMTP traffic with SNAT while somehow be able (on the backend server) to tell what was the original source IP?
So there's no X-Forwarded-For - type trick to be used here sorry 🙂
Why don't you assign a specific SNAT address, to be used ONLY for your authorised SMTP virtual server (so you'd use a SNAT pool instead of automap, with one pool member), and then give the mail guys the SNAT address to configure on the Mail server?
F5 can pass the Proxy Protocol info to Postfix via a simple iRule:
when CLIENT_ACCEPTED priority 100 {
set proxyheader "PROXY TCP[IP::version] [IP::remote_addr] [IP::local_addr] [TCP::remote_port] [TCP::local_port]\r\n"
}
when SERVER_CONNECTED priority 100 {
TCP::respond $proxyheader
}
and on Postfix side, you can edit master.cf as follows:
smtp inet n - n - - smtpd
10025 inet n - n - 1 postscreen
-o syslog_name=postfix/f5
-o postscreen_upstream_proxy_protocol=haproxy
-o postscreen_upstream_proxy_timeout=5s
smtpd pass - - n - - smtpd
Then, create a simple TCP VS on F5, listening on port 25/tcp and forwarding all your SMTP traffic to your back-end postfix server on port 10025/tcp.
With the above, you can either talk directly to your back-end server on port 25/tcp, or talk to F5 VS on port 25/tcp. In both cases, Postfix will see real client's IP.
---
I wish F5 had a native support for SMTP protocol the same way they have it for LDAP (see Client LDAP Profile), to allow STARTTLS Activation Mode. Plus a built in support for proxy protocol in all their profiles.
If your F5 talks to your postfix on port 25 then you certainly won't see the real client's IP but F5 IP instead.
The configuration in master.conf is important. It tells postfix to start a listener on port 10025 and attach proxy protocol to it. You are not supposed to talk directly to 10025 via telnet in this case. F5 is supposed to talk to your postfix on port 10025 with that proxy protocol iRule enabled, not to port 25.
