Forum Linux.général Pb Postfix (LAN/DMZ)

Bonjour,

Je rencontre quelques soucis avec mon serveur Postfix, la configuration est la suivante:

----------Net----------[Pare-Feu]------DMZ----Postfix


                              |


                              +-----------LAN----- clients locaux

Le principal "souci" est que mon prédecesseur a configuré le Fw de façon à ce que tout le trafic mail (entrant externe et local) arrive sur la DMZ au serveur smtp par la même interface/@IP, ce qui fait que j'ai un peu de mal à configurer l'antispam et l'antirelay sans bloquer mes utilisateurs locaux.

J'ai fait le maximum, mais certains pourriels arrivent à etre relayés malgré cela.

Auriez-vous une éventuelle solutions à me proposer sans casser toute la configuration?

voici mon fichier main.cf, j'ai peut-être mal placé certaines règles, ou j'en ai oublié ...

Merci d'avance de vos conseils/suggestions.

# /etc/postfix/main.cf


# Configuration Postfix


#


# --------------------------------------------------------------------------------


alias_maps = hash:/etc/aliases


alias_database = hash:/etc/aliases





smtpd_banner = $myhostname ESMTP (Debian/GNU)





# Quelques limitations


bounce_queue_lifetime = 6h


maximal_queue_lifetime = 6h





queue_run_delay = 300s


minimal_backoff_time = 300s


maximal_backoff_time = 600s





qmgr_clog_warn_time = 0


queue_minfree = 51200000


default_process_limit = 20


duplicate_filter_limit = 50


default_recipient_limit = 50


default_extra_recipient_limit = 50


qmgr_message_active_limit = 50


qmgr_message_recipient_limit = 50


smtpd_recipient_limit = 50


smtpd_recipient_overshoot_limit = 50


virtual_alias_expansion_limit = 50


virtual_alias_recursion_limit = 50





disable_vrfy_command = yes


smtpd_helo_required = yes


smtpd_helo_restrictions = reject_non_fqdn_hostname





append_dot_mydomain = yes





mydestination = $myhostname, localhost.$mydomain





local_transport = virtual





local_recipient_maps = $virtual_mailbox_maps $alias_maps





inet_interfaces = all





# --------------------------------------------------------------------------------


# restrictions d'acces


smtpd_reject_unlisted_sender = yes


smtpd_restriction_classes = has_our_domain_as_sender





has_our_domain_as_sender = check_sender_access hash:/etc/postfix/our_domain_as_sender


  reject





smtpd_sender_restrictions = reject_unknown_sender_domain,


        reject_non_fqdn_sender,


        check_sender_access hash:/etc/postfix/sender_restriction,


        reject_rhsbl_sender relays.ordb.org,


        reject_rhsbl_sender opm.blitzed.org,


        reject_rhsbl_sender dsn.rfc-ignorant.org,


        reject_rhsbl_sender rddb.dnsbl.net.au,


        reject_rhsbl_sender endn.dnsbl.net.au,


        permit





smtpd_recipient_restrictions = reject_non_fqdn_recipient,


        reject_non_fqdn_sender,


        reject_unknown_recipient_domain,


        reject_unlisted_recipient,


        reject_unlisted_sender,


        permit_mynetworks,


        reject_non_fqdn_helo_hostname,


        reject_unauth_destination,


        check_sender_access hash:/etc/postfix/our_domain_as_sender,


        check_sender_access hash:/etc/postfix/sender_access,


        check_policy_service inet:127.0.0.1:60000,


        reject_rbl_client bl.spamcop.net,


        reject_rbl_client sbl-xbl.spamhaus.org,


        check_helo_access hash:/etc/postfix/helo_access,


        reject_invalid_hostname,


        reject_non_fqdn_hostname,


        reject_unknown_hostname,


        reject_unknown_sender_domain,


        reject_unknown_recipient_domain,


        reject_unauth_pipelining,


        reject_unknown_client








smtpd_data_restrictions = reject_unauth_pipelining,


        permit








swap_bangpath = no


unknown_address_reject_code = 554


unknown_client_reject_code = 554


unknown_hostname_reject_code = 554





# client


smtpd_client_restrictions =


        reject_unknown_client,


        permit_mynetworks





# mails pour IMAP


home_mailbox = /





# --------------------------------------------------------------------------------


# comptes virtuels/mySQL


#


virtual_mailbox_base = /var/spool/vmail/


virtual_alias_maps = mysql:/etc/postfix/mysql/mysql_virtual_alias_maps.cf


virtual_mailbox_domains = mysql:/etc/postfix/mysql/mysql_virtual_domains_maps.cf


virtual_mailbox_maps = mysql:/etc/postfix/mysql/mysql_virtual_mailbox_maps.cf


virtual_uid_maps = static:5000


virtual_gid_maps = static:5000





# pour les quotas


virtual_create_maildirsize = yes


virtual_mailbox_extended = yes


virtual_mailbox_limit_maps = mysql:/etc/postfix/mysql/mysql_virtual_mailbox_limit_maps.cf


virtual_mailbox_limit_override = yes


virtual_maildir_limit_message = "La boite mail de l'utilisateur est pleine, essayez plus tard."


virtual_overquota_bounce = yes





# mails livres par maildrop


# virtual_transport = virtual


virtual_transport = maildrop


maildrop_destination_recipient_limit = 1


maildrop_destination_concurrency_limit = 1





# fin du fichier


#