You want multiple IP Addresses for email if you are hosting more than one domain. The reason is, everyone now checks for reverse DNS with email so you need a different public IP Address for each email domain. This way, all the reverse DNS translations will be unique. For apache, you can have multiple websites sharing the same IP Address as long as you don''t do anything with SSL. SSL requires a unique IP Address for every website because of the way the protocol works. So you can use either name virtual hosts or IP based virtual hosts, your choice. Note that if you are hosting email and websites for the same domain, it **might** be convenient for the email and website for each domain to share an IP Address. Let''s say you decide you want unique IP Addresses for everything. Let''s also say you have an external address range of, say, 1.2.3.0/29. So this gives you the following IP Addresses, which we will asign like this: 1.2.3.0 not ussable - defines the network 1.2.3.1 Outside (WAN) firewall interface 1.2.3.2 Public IP for first email 1.2.3.3 Public IP for 2nd email 1.2.3.4 Public IP for first website 1.2.3.5 Public IP for 2nd website 1.2.3.6 available for other stuff 1.2.3.7 defines the broadcast Let''s further say you have an internal LAN with, say, 192.168.0.0/24. Let''s assign these IP Addresses: 192.168.0.1 Inside (LAN) firewall interface This is the internal gateway everyone uses 192.168.0.2 Private IP for first email 192.168.0.3 Private IP for 2nd email 192.168.0.4 Private IP for first website 192.168.0.5 Private IP for 2nd website Note that hosts 192.168.0.2 through .5 all point to the same physical box. This box could be Linux, Windows, or (pick your poison). It hosts all the websites and email domains. So you have a firewall at 192.168.0.1 and another box with .2 thru .5. The firewall has 2 interfaces - one inside and one outside. Let''s say that interface eth0 is the outside and eth1 is inside. Next we need firewall rules. Here are some code fragments that should minimally do the trick: ***************************************************************** . . . PUBLIC_EMAIL1_IP="1.2.3.2" # First mail server PRIVATE_EMAIL1_IP="192.168.0.2" PUBLIC_EMAIL2_IP="1.2.3.3" # 2nd mail server PRIVATE_EMAIL2_IP="192.168.0.3" PUBLIC_WEB1_IP="1.2.3.4" # First web server PRIVATE_WEB1_IP="192.168.0.4" PUBLIC_WEB2_IP="1.2.3.5" # 2nd web server PRIVATE_WEB2_IP="192.168.0.5" . . . # Email might butcher the text wrapping below /sbin/ifconfig eth0:0 $PUBLIC_EMAIL1_IP netmask 255.255.255.248 broadcast 1.2.3.7 /sbin/ifconfig eth0:1 $PUBLIC_EMAIL2_IP netmask 255.255.255.248 broadcast 1.2.3.7 /sbin/ifconfig eth0:2 $PUBLIC_WEB1_IP netmask 255.255.255.248 broadcast 1.2.3.7 /sbin/ifconfig eth0:3 $PUBLIC_WEB2_IP netmask 255.255.255.248 broadcast 1.2.3.7 # You need a POSTROUTING rule for email. echo " Email (outbound SMTP, port 25)" $IPTABLES -t nat -A POSTROUTING -o eth0 -p TCP --dport 25 \ -s $PRIVATE_EMAIL1_IP -j SNAT --to $PUBLIC_EMAIL1_IP . . . # You need FORWARDing rules. Email might butcher text wrapping. echo " Email packets for ports 25 (SMTP), 110 (POP3), and 143 (IMAP)" $IPTABLES -A FORWARD -p TCP --dport 25 -s 0/0 -d $PRIVATE_EMAIL1_IP -j ACCEPT $IPTABLES -A FORWARD -p TCP --dport 110 -s 0/0 -d $PRIVATE_EMAIL1_IP -j ACCEPT $IPTABLES -A FORWARD -p TCP --dport 143 -s 0/0 -d $PRIVATE_EMAIL1_IP -j ACCEPT $IPTABLES -A FORWARD -p TCP --dport 25 -s 0/0 -d $PRIVATE_EMAIL2_IP -j ACCEPT $IPTABLES -A FORWARD -p TCP --dport 110 -s 0/0 -d $PRIVATE_EMAIL2_IP -j ACCEPT $IPTABLES -A FORWARD -p TCP --dport 143 -s 0/0 -d $PRIVATE_EMAIL2_IP -j ACCEPT echo " WWW packets (port 80)" $IPTABLES -A FORWARD -p TCP --dport 80 -s 0/0 -d $PRIVATE_WEB1_IP -j ACCEPT $IPTABLES -A FORWARD -p TCP --dport 80 -s 0/0 -d $PRIVATE_WEB2_IP -j ACCEPT . . . # And you need PREROUTING rules echo " HTTP" $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_WEB1_IP \ -p tcp --dport 80 -j DNAT --to $PRIVATE_WEB1_IP $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_WEB2_IP \ -p tcp --dport 80 -j DNAT --to $PRIVATE_WEB2_IP echo " Email - SMTP, POP3, and IMAP" $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_EMAIL1_IP \ -p tcp --dport 25 -j DNAT --to $PRIVATE_EMAIL1_IP $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_EMAIL1_IP \ -p tcp --dport 110 -j DNAT --to $PRIVATE_EMAIL1_IP $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_EMAIL1_IP \ -p tcp --dport 143 -j DNAT --to $PRIVATE_EMAIL1_IP $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_EMAIL2_IP \ -p tcp --dport 25 -j DNAT --to $PRIVATE_EMAIL2_IP $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_EMAIL2_IP \ -p tcp --dport 110 -j DNAT --to $PRIVATE_EMAIL2_IP $IPTABLES -t nat -A PREROUTING -i eth0 -d $PUBLIC_EMAIL2_IP \ -p tcp --dport 143 -j DNAT --to $PRIVATE_EMAIL2_IP Note that you can inmprove on the rules in the FORWARD chain. You''ll want to test for RELATED and ESTABLISHED and not just blindly ACCEPT incoming packets on those ports. Think about jumping to a user defined table that tests for this instead of directly to ACCEPT. - Greg Scott -----Original Message----- From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] On Behalf Of Aleksander Sent: Monday, January 02, 2006 10:08 AM To: lartc@mailman.ds9a.nl Subject: Re: Fwd: [LARTC] Several IP''s, one mail and http server Edmundo Carmona wrote:>There was a typo. It was DNAT, and not DAN > >---------- Forwarded message ---------- >From: Edmundo Carmona <eantoranz@gmail.com> >Date: Jan 2, 2006 11:47 AM >Subject: Re: [LARTC] Several IP''s, one mail and http server >To: lartc <LARTC@mailman.ds9a.nl> > > >If I understand correctly, the server is not directly connected to the >internet, right? > >There are some boxes connected to the internet instead... am I right? > >One connection, several IP addrs with their own host names. One gateway with these several external IPs. The gateway has one internal IP too, of course. The gateway does SNAT for the internal LAN. Clients connect to the gateway using different hostnames and therefore different IP''s. They are connecting to a webserver, which is in the internel LAN. They can connect thanks to DNAT (one DNAT for each IP to the same box in the LAN). When the server on the internal LAN answers the requests, his external IP is assigned by the SNAT rule. If that external IP is not the same as the one to which the client connected, the client will drop the servers responses --- they come from a different IP, as he connected to in the first place. The only way I see to make it work would have apache to use IP based virtual hosts. That requires virtual interfaces, correct? By clients I mean random users all over the Internet who connect to different IPs on the same gateway. How other machines in the LAN connect to the webserver using valid hostnames is another business, easily resolved with DNS zones. Hope you can figure this out. Thanks for interest, I''ll be back tomorrow. Alex _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
W Twoim liście datowanym 2 stycznia 2006 (18:51:25) można przeczytać: GS> You want multiple IP Addresses for email if you are hosting more than GS> one domain. The reason is, everyone now checks for reverse DNS with GS> email so you need a different public IP Address for each email domain. GS> This way, all the reverse DNS translations will be unique. IMHO it is not true. Novadays, it is required for a mail server to have a valid reverse dns record. But it doesn''t have to point back to the same name. It would lead to very very poor IP space usage - eg. virtual hosting provider, which has 300 domains would need 300 IP''s even if all of them are hosted on 1 machine, and number of domains can MUCH higher than all of the IPs. mail.domainA.com - WW.XX.YY.ZZ ZZ.YY.XX.WW.in-addr.arpa PTR - host.domainB.com host.domainB.com - WW.XX.YY.ZZ for an egzample one of the bigest portals - yahoo: dig yahoo.com MX - mx1.mail.yahoo.com - 67.28.113.10, 67.28.113.11 dig 10.113.28.67.in-addr.arpa PTR - mta-v4.level3.mail.yahoo.com. dig mta-v4.level3.mail.yahoo.com. - 67.28.113.10 Citation from one of the mail server manuals: If you have a PTR record for your IP address, and the target of the PTR record has an A record pointing back to that same IP address, mail will not be rejected from your server due to an invalid PTR. -- Pozdrowienia, Robert Kurjata
>> IMHO it is not true. Novadays, it is required for a mail server to have a valid >> reverse dns record. But it doesn''t have to point back to the same name. It would >> lead to very very poor IP space usage - eg. virtual hosting provider, which has >> 300 domains would need 300 IP''s even if all of them are hosted on 1 machine, >> and number of domains can MUCH higher than all of the IPs.I wish! I''ve run across places that seem to check that the reverse DNS matches the forward DNS name. I''ve seen it with Comcast and I gotta believe there are others doing it. It is a pain for me because I have to consume a precious IP Address for each email domain I host here. It may be possible that the big hosters know about each other and make special arrangements with each other to which little ol'' me is not privvy. If anyone out there has any connections with the Comcast DNS people, I''d love to talk to you about this and other issues - but we''re straying off the original topic. - Greg -----Original Message----- From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] On Behalf Of Robert Kurjata Sent: Monday, January 02, 2006 4:02 PM To: lartc@mailman.ds9a.nl Subject: Re[2]: Fwd: [LARTC] Several IP''s, one mail and http server W Twoim liście datowanym 2 stycznia 2006 (18:51:25) można przeczytać: GS> You want multiple IP Addresses for email if you are hosting more GS> than one domain. The reason is, everyone now checks for reverse DNS GS> with email so you need a different public IP Address for each email GS> domain. This way, all the reverse DNS translations will be unique. IMHO it is not true. Novadays, it is required for a mail server to have a valid reverse dns record. But it doesn''t have to point back to the same name. It would lead to very very poor IP space usage - eg. virtual hosting provider, which has 300 domains would need 300 IP''s even if all of them are hosted on 1 machine, and number of domains can MUCH higher than all of the IPs. mail.domainA.com - WW.XX.YY.ZZ ZZ.YY.XX.WW.in-addr.arpa PTR - host.domainB.com host.domainB.com - WW.XX.YY.ZZ for an egzample one of the bigest portals - yahoo: dig yahoo.com MX - mx1.mail.yahoo.com - 67.28.113.10, 67.28.113.11 dig 10.113.28.67.in-addr.arpa PTR - mta-v4.level3.mail.yahoo.com. dig mta-v4.level3.mail.yahoo.com. - 67.28.113.10 Citation from one of the mail server manuals: If you have a PTR record for your IP address, and the target of the PTR record has an A record pointing back to that same IP address, mail will not be rejected from your server due to an invalid PTR. -- Pozdrowienia, Robert Kurjata _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Greg Scott wrote:>I wish! I''ve run across places that seem to check that the reverse DNS matches the forward DNS name. I''ve seen it with Comcast and I gotta believe there are others doing it. It is a pain for me because I have to consume a precious IP Address for each email domain I host here. It may be possible that the big hosters know about each other and make special arrangements with each other to which little ol'' me is not privvy. If anyone out there has any connections with the Comcast DNS people, I''d love to talk to you about this and other issues - but we''re straying off the original topic. > >- Greg > >My mailservers will have their own reverse. ATM they don''t and work fine too. It''s not an issue. Sorry to hear you have to mess with that. What you proposed is kind of the thing I had in mind. Instead of all the forwarding rules I use "echo 1 > /proc/sys/net/ipv4/ip_forward". Is the additional checking you propose worth it? So the question, if I have to create virtual interfaces on the internal box should be answered "YES, that''s the only way"? Have you had experience setting up postfix to work on several interfaces? I have an idea, how to make apache work, quite familiar with virtual hosts, but not postfix. It''s not really a topic for this list though. Thanks, Alex Note: I seem to be missing the the first email of Greg, the one Robert quoted. No idea why, there''s even no spam filtering at my end. Found it in the archives anyway.
> What you proposed is kind of the thing I had in mind. Instead of allthe> forwarding rules I use "echo 1 > /proc/sys/net/ipv4/ip_forward". Isthe> additional checking you propose worth it?Even with the approach I proposed you still have to turn on ip_forward. If you''re going to use multiple IP Addresses, somebody has to listen on all those addresses and the firewall is the right box to do it - that is its job. So then you set up appropriate DNAT, SNAT, and FORWARDing rules so the application servers only see traffic they are supposed to see. There are probably other ways to do it, but this is the way I use and it works well. Re: Postfix - I spent lots of time inside this book: Postfix, Richard Blum, Sams Publishing, 2001. I''ll bet there''s a newer edition out by now. - Greg -----Original Message----- From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] On Behalf Of Aleksander Sent: Tuesday, January 03, 2006 1:16 AM To: lartc@mailman.ds9a.nl Subject: Re: Fwd: [LARTC] Several IP''s, one mail and http server Greg Scott wrote:>I wish! I''ve run across places that seem to check that the reverse DNS>matches the forward DNS name. I''ve seen it with Comcast and I gottabelieve there are others doing it. It is a pain for me because I have to consume a precious IP Address for each email domain I host here. It may be possible that the big hosters know about each other and make special arrangements with each other to which little ol'' me is not privvy. If anyone out there has any connections with the Comcast DNS people, I''d love to talk to you about this and other issues - but we''re straying off the original topic.> >- Greg > >My mailservers will have their own reverse. ATM they don''t and work fine too. It''s not an issue. Sorry to hear you have to mess with that. What you proposed is kind of the thing I had in mind. Instead of all the forwarding rules I use "echo 1 > /proc/sys/net/ipv4/ip_forward". Is the additional checking you propose worth it? So the question, if I have to create virtual interfaces on the internal box should be answered "YES, that''s the only way"? Have you had experience setting up postfix to work on several interfaces? I have an idea, how to make apache work, quite familiar with virtual hosts, but not postfix. It''s not really a topic for this list though. Thanks, Alex Note: I seem to be missing the the first email of Greg, the one Robert quoted. No idea why, there''s even no spam filtering at my end. Found it in the archives anyway. _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc