Yea, I guess that was my original question when I asked about NAT.
Forgive me if I ask a dumb question but.. I thought that the source TCP address wasn’t an issue because much of the spam prevention will look at mail headers not just the TCP source IP of the last relay before mail got to qmail. On Mar 11, 2014, at 2:38 PM, Eric Shubert <[email protected]> wrote: > On 03/11/2014 10:46 AM, Scot Needy wrote: >> The device is behind a firewall/SLB. > > So I take it that all of the messages appear to be coming from the 10.x > address. spamdyke's pretty much ineffective that way, because it relies > heavily on the sender's IP address for many of its filters. > >> I can't make the source IP transparent at this time. My only other >> option would be to stand it up directly on the public network. > > Making the source IP transparent would be the best solution. Many people put > QMT directly on the public network though. Just be sure to have iptables > configured appropriately (and enabled). I think the firewall.sh scripts does > a good job of this. I don't recall any complaints about it. > > -- > -Eric 'shubes' > >> On Mar 11, 2014, at 1:23 PM, Eric Shubert <[email protected] >> <mailto:[email protected]>> wrote: >> >>> On 03/11/2014 09:57 AM, Scot Needy wrote: >>>> NOTE: All sender domains and IP’s have been replaced with a unique name. >>>> >>>> >>>> CHKUSER accepted sender: from<[email protected] >>>> <mailto:[email protected]>::> remote >>>> <na01-by2-obe.outbound.protection.outlook.com:unknown:10.189.254.17> >>>> rcpt <> : sender accepted >>>> spamdyke[8804]: DENIED_OTHER from:[email protected] >>>> <http://mydomain.com> to:[email protected] >>>> <http://supportdomain.com> origin_ip: 10.189.254.17 origin_rdns: >>>> (unknown) auth: (unknown) encryption: TLS reason: >>>> 550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_ >>>> <http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_>(#5.7.1) >>>> >>>> CHKUSER accepted sender: from<[email protected] >>>> <mailto:[email protected]>::> remote >>>> <na01-bn1-obe.outbound.protection.outlook.com:unknown:10.189.254.17> >>>> rcpt <> : sender accepted >>>> spamdyke[16794]: DENIED_OTHER from:[email protected] >>>> <http://mydomain.com> to:[email protected] >>>> <http://supportdomain.com> origin_ip: 10.189.254.17 origin_rdns: >>>> (unknown) auth: (unknown) encryption: TLS reason: >>>> 550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_ >>>> <http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_>(#5.7.1) >>>> >>>> CHKUSER accepted sender: from<[email protected] >>>> <mailto:[email protected]>::> remote >>>> <na01-bn1-obe.outbound.protection.outlook.com:unknown:10.189.254.17> >>>> rcpt <> : sender accepted >>>> spamdyke[31470]: DENIED_OTHER from:[email protected] >>>> <http://mydomain.com> to:[email protected] >>>> <http://supportdomain.com> origin_ip: 10.189.254.17 origin_rdns: >>>> (unknown) auth: (unknown) encryption: TLS reason: >>>> 550_See_http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_ >>>> <http://spf.pobox.com/why.html?sender=Joe-Customer%40mydomain.com&ip=10.189.254.17&receiver=mail-01.mydomain.com_>(#5.7.1) >>>> >>>> >>> >>> Looks to me as though there may be a firewall-type device on your >>> perimeter which is doing more than simply NAT. The origin_ip is >>> typically the address of the sending host, which would be public. This >>> holds true even when QMT is behind a NAT'ing firewall (I typically do >>> this). >>> >>> Isoutlook.com <http://outlook.com/>the only domain you have messages >>> coming from which show this 10. address? >>> >>> Is there some sort of VPN going on here? >>> >>> What device is sitting on the immediate outside of QMT? >>> >>> -- >>> -Eric 'shubes' >>> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail:[email protected] >>> <mailto:[email protected]> >>> For additional commands, >>> e-mail:[email protected] >>> <mailto:[email protected]> >> > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
