🚀 go-pugleaf

Hi all,

I am having some problems with email redirection when using a 3 legged
configuration on my firewall.  Having read ALL the manuals and then some :)
I have racked my brain over this for the last couple of days!!  If anyone
has any suggestions, I would be most appreciative.

The outline of the setup is shown below:

SHDSL
External
||
||
fxp2
------------
| Firewall   | fxp1 === DMZ (192.168.10.0/30)
------------
fxp0
||
||
Internal
LAN
(192.168.0.0/26)

Each of the interfaces has a STATIC ip address as shown:

fxp0 192.168.0.1/32
fxp1 192.168.10.1/32
fxp2 aaa.bbb.ccc.ddd/32

The Mail Server is directly connected (via x-over) in the DMZ to fxp1.
The Mail Server has IP: 192.168.10.2/32
The Firewall has routes between DMZ <-> LAN, LAN <-> External, WORLD <-> DMZ
The Mail Server has routes between DMZ -> LAN, DMZ -> WORLD

The IPNAT.RULES are provided below
#####################################
#
# Application Proxies
map fxp2 192.168.0.0/26 -> fxp2/32 proxy port ftp ftp/tcp
map fxp2 192.168.10.0/30 -> fxp2/32 proxy port ftp ftp/tcp
# Internal Network NAT Mapping
map fxp2 192.168.0.0/26 -> fxp2/32 portmap tcp/udp auto
map fxp2 192.168.0.0/26 -> fxp2/32
# DMZ Network NAT Mapping
map fxp2 192.168.10.0/30 -> fxp2/32 portmap tcp/udp auto
map fxp2 192.168.10.0/30 -> fxp2/32
# Redirect SMTP
# use 0/32 to redirect ALL incoming SMTP on FXP2
rdr fxp2 0/32 port smtp -> 192.168.10.2 port smtp
rdr fxp0 0/32 port smtp -> 192.168.10.2 port smtp
EOF

The IPF.RULES is below
########################################
# References:
# http://www.obfuscation.org/ipf/ipf-howto.html
# http://www.drones.com/obsd29-fw.html
# http://www.onlamp.com/pub/a/bsd/2002/02/28/openbsd.html
########################################
# Don't Bother Local Loopback
pass in quick on lo0 all
pass out quick on lo0 all
########################################
# Don't Bother the Internal or DMZ
pass in quick on fxp0
pass out quick on fxp0
pass in quick on fxp1
pass out quick on fxp1
########################################
#
# Secure the External Interface
#
# Block ICMP Redirections and Fragments
... <lots of stuff here - see references>
# Block Private Traffic from Entering
... <lots of stuff here - see references>
# Block Source Routed Packets
... <lots of stuff here - see references>
# Block Private Traffic from Escaping
... <lots of stuff here - see references>
########################################
# Filter Incoming & Outgoing Traffic
# Allow ICMP for Ping & Traceroute
pass in quick on fxp2 proto icmp from any to any icmp-type echorep
pass in quick on fxp2 proto icmp from any to any icmp-type echo
pass in quick on fxp2 proto icmp from any to any icmp-type timex
pass in quick on fxp2 proto icmp from any to any icmp-type unreach
block in log quick on fxp2 proto icmp from any to any
# Allow SSH & SMTP
#
pass in quick on fxp2 proto tcp from any to any port = smtp flags S keep
frags keep state
pass in quick on fxp2 proto tcp from any to any port = ssh flags S keep
frags keep state
# Allow VPN Traffic
#
pass in quick on fxp2 proto esp from eee.fff.ggg.hhh/32 to
aaa.bbb.ccc.ddd/32
pass in quick on enc0 from 192.168.1.0/29 to 192.168.0.0/26
pass in quick on enc0 from 192.168.1.0/29 to 192.168.10.0/30
pass out quick on fxp2 proto esp from aaa.bbb.ccc.ddd/32 to
eee.fff.ggg.hhh/32
pass out quick on enc0 from 192.168.0.0/26 to 192.168.1.0/29
pass out quick on enc0 from 192.168.10.0/30 to 192.168.1.0/29
# Pass Outgoing Network Traffic
#
pass out quick on fxp2 proto tcp from any to any flags S keep frags keep
state
pass out quick on fxp2 proto udp from any to any keep state
pass out quick on fxp2 proto icmp from any to any keep state
# Block Everything else on External Interface
#
block return-rst in log quick on fxp2 proto tcp from any to any
block return-icmp-as-dest in log quick on fxp2 proto udp from any to any
block in log quick on fxp2 all
EOF

Thats it - the mail domain for the mail server has been setup by my ISP,
with the MX record pointing to the firewall.mydomain.com (reverse PTR also
configured by ISP).  I can send mail from the firewall to the mail server,
but I cant seem to send mail from the world to the mail server.  IPnat
records a connection - IPfilter lets the connection through - but I dont get
any email :(

Anyway - any thoughts are most welcome :)

Regards
MoRpHinE