Re: sender+ip restrictions

2 msg	MASQUERADING FROM BUT NOT TO
3 msg	Probably not a Postfix problem...?
3 msg	Quick question with user/virtual aliases.
4 msg	Sending healty batch emails
5 msg	use of relayhost, relaydomain?
6 msg	naming the mail server
1 msg	Re: statistics by client ip address - SOLVED
3 msg	question marks on permissions/owner
2 msg	Configuring Postfix to Receive Mail from Outloo...
3 msg	tcp_table and propose for new lookup table 'pip...
12 msg	About date spoofing
3 msg	Overriding DNS lookups for a specific domain
2 msg	redirecting a single email address/alias (not a...
1 msg	statistics by client ip address

sender+ip restrictions
\ Dan Lannom (13 Mar 2008)
. \ mouss (13 Mar 2008)

14 msg	postfix-2.5 RPMs available
1 msg	Setting up Postfix on Solaris 10
8 msg	Yet another virtual domain problem - do not lis...
2 msg	getting a user permissions error
2 msg	551 mail refused

Subject:	Re: sender+ip restrictions
Group:	Postfix-users
From:	mouss
Date:	13 Mar 2008

Dan Lannom wrote:
> We want to accept email with a specific envelope sender from only a
> specific ip range and then deliver it, bypassing our spam filters.
>
> I've not been able to locate a good solution for this on our mx servers.
> SPF is not a good choice, for example, since the group sending can't
> seem to handle it[or even setup mx records that match their sending
> domain]. I also don't want to just trust that the sending domain would
> not be spoofed.
>
> The current plan is to have them relay through a separate machine as a
> trusted relay using a custom mail domain that remaps the recipient into
> our normal mail domain using canonical.
>
> Is there a better way? Can we accept email from @some.domain.com only
> for 1.2.3.0/24 using normal postfix configurations? [ie. no custom
> policy server]
>

use restriction classes.

smtpd_restriction_class =
whitelist_from
skip_filter

smtpd_recipient_restrictions =
...
reject_unauth_destination
...
check_sender_access hash:/etc/postfix/sender_acl
...

whitelist_from =
check_client_access cidr:/etc/postfix/client_from

skip_filter =
check_client_access pcre:/etc/postfix/filter_trusted
permit

== sender_acl
foo whitelist_from
donotwhitelist DUNNO
example.net whitelist_from

== client_from
1.2.3.0/24 skip_filter

== filter_trusted
/./ FILTER scan:[127.0.0.1]:10586

where 10586 is the port for virus scanning only (or use 10025 to skip
any filtering, ... at your own risk).