I'm trying to get an internal SMTP server to be the only machine allowed to make external SMTP connections. The easiest way I've found of doing that (due to ipnat,ipf order and NAT) is to have our firewall round-robin outbound SMTP connections to our border SMTP servers, while redirecting all others (via a local proxy) back to the internal SMTP server. (If anyone has any other suggestions, or wants more details, just ask. I'm all ears.)
Since I'm still in the transition stage, instead of running the proxy, we are simply redirecting all outbound mail to another SMTP server, to do the scanning we need... So if the internal SMTP server is 192.168.0.100 (on a /24), my ipnat rules are as such: rdr rl0 from 192.168.0.100 to 0/0 port = 25 -> 168.192.0.1,168.192.0.2 port 25 tcp round-robin rdr rl0 0/0 port 25 -> 168.192.0.3 port 25 tcp Now, if I make an outbound SMTP connection from 192.168.0.99, I get redirected properly to 168.192.0.3. The problem is if I make the connection from 192.168.0.100... The first connection goes to 168.192.0.1. The second connection goes to 168.192.0.2. All subsequent connections go to 168.192.0.3. I pulled my configuration from the IPF HOWTO (which has a typo -- there's no trailing 'round-robin' keyword) and some FreeBSD documentation (the firewall is running FreeBSD). I've never done round-robin before, so it could be my misconfiguration, but it looks right according to the docs I've seen...
