Routing

[Scully87]

Hello All,
Here's the senerio.
I'm testing a new email server with a test domain name. mydomain.net. I also have my production mail server mydomain.com. They're both behind my linux firewall. Right now routing works fine. Incoming and out going mail works, if I only have one going at a time. They will both send out going but only one recieves incomming mail. The problem is in the iptables script. Here's what my mail routing/forwarding looks like now:


#Forwarding related to mail:
iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp -d $INTSMTP --dport 25 -j ACCEPT

#Forwarding incomming SMTP connections:
iptables -t nat -A PREROUTING -i $EXTIF -p tcp -d $EXTIP --dport 25 -j DNAT --to $INTSMTP:25

I would like to be able to route/forward the incomming mail by host destination. For example mail hitting the firewall bound for mydomain.com(production) gets routed to the Production mail server. Mail bound for mydomain.net(Lab) gets routed to the test mail server.

I tried changing the -d $EXTIP variable to -d mydomain.net also -d mail.mydomain.net

That resulted in the firewall blocking the incomming attempt. I tried placing this rule in front of the change:

iptables -A INPUT -i $EXTIF -p tcp -s $UNI -d $EXTIP --dport 25 -j ACCEPT


That resulted in the incomming mail not being blocked but it still would not route to the test mail server. I had to add an entry to my host file with the name and ip of the internal server which is on a private IP.


Any ideas?
Thanks in advance
Cheers,

Scully

[Scully87]

Bump

[homey]

I may be just blowing hot air here but anyway......

The router part is working ok and like it should. Mainly to let the mail come in through the smtp port.

I wonder if you would be better off looking into mail relay from the first mail server to the second one.

Just a thought :)

[Leigh]

You may want to look into domain routing or domain masquerading on your mail server. Your IP stuff is all working, as IPTABLES won't look at the destination email address on the incoming emial, just the IP address it is destined for.
Alternatively, try using a different MX record for your two domains.

[Scully87]

Ahhhh....very good things to think about. Thank you both.
@Leigh, I do have different MX records for both mail servers.
Both domains are hosted externally.
Also in the man page for IPtables I believe it said you could use hostnames as an argument for source or destination, that's what I was trying to get to work, but I think your right, it won't see what domain it's destined for....it's looking for the IP.

Thanks to both of you again.
Regards,
Scully