Hi,
We have an issue with our mail server on Solaris. When our mail server
tries to send mail to some hosts it fails with a time out message. This
only occurs with the combination of Solaris and Cisco PIX. Unfortunately
their doesn't seem to be a solution (I've checked the postfix mailinglist).
The mails can be delivered when a Linux box sends a mail. What I want to
accomplish is the following:
1. Let fail2ban check the maillog and look for the error.
2. When a error is found add a line top ipnat "rdr bge0 [IP CISCO PIX MAIL
SERVER]/32 port 25 -> [IP OUR LINUX MAIL SERVER] port 25 tcp"
3. The next time a delivery attempt is made the message so be delivered to
our linux mail server which will relay the message (this is tested and
proven to work)
Unfortunately I can't get the rdr line to work. What is wrong with it?
#### output from the solaris machine (213.207.89.178)
$ echo "rdr bge0 213.207.90.2 port 25 -> 93.186.180.60 port 25 tcp" |
pfexec ipnat -f -
$ pfexec ipnat -l
List of active MAP/Redirect filters:
rdr bge0 213.207.90.2/32 port 25 -> 93.186.180.60 port 25 tcp
List of active sessions:
$ routeadm
Configuration Current Current
Option Configuration System State
---------------------------------------------------------------
IPv4 routing enabled enabled
IPv6 routing disabled disabled
IPv4 forwarding enabled enabled
IPv6 forwarding disabled disabled
Routing services "route:default ripng:default"
Routing daemons:
STATE FMRI
disabled svc:/network/routing/ripng:default
disabled svc:/network/routing/legacy-routing:ipv4
disabled svc:/network/routing/legacy-routing:ipv6
disabled svc:/network/routing/rdisc:default
online svc:/network/routing/route:default
online svc:/network/routing/ndp:default
$ pfexec ipfstat -i
pass in log quick proto icmp from any to any icmp-type routersol
pass in log quick proto icmp from any to any icmp-type routerad
$ pfexec ipfstat -o
empty list for ipfilter(out)
$ telnet 213.207.90.2 25
Trying 213.207.90.2...
Connected to 213.207.90.2.
Escape character is '^]'.
220 stevie.youngguns.nl ESMTP
$ telnet 93.186.180.60 25
Trying 93.186.180.60...
Connected to 93.186.180.60.
Escape character is '^]'.
220 marcus.youngguns.nl ESMTP
Thanks
Martijn
--
YoungGuns
Kasteleinenkampweg 7b
5222 AX 's-Hertogenbosch
T. 073 623 56 40
F. 073 623 56 39
www.youngguns.nl
KvK 18076568
