Proxmox Mail Gateway. Deployment Guide 8/23/2017. MailGatewayDeploymentGuide-V2.3.docx

Transcription

1 Proxmox Mail Gateway Deployment Guide 8/23/2017 MailGatewayDeploymentGuide-V2.3.docx

2 Proxmox Server Solutions GmbH reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the latest version of this document, which is available from NOTE: All prices are one year subscription licenses. After expiration, flow continues but Spamand AV checks are not working anymore (Exception: ClamAV will continue working). All other product or company names different from Proxmox may be trademarks or registered trademarks of their owners. Copyright Proxmox Server Solutions GmbH. All rights reserved. No part of this publication may be reproduced, photocopied, stored in a retrieval system, or transmitted without the express prior written consent of Proxmox Proxmox Server Solutions GmbH 2 42

3 Table of Contents 1 Introduction Proxmox Mail Gateway integration system without Proxmox Mail Gateway system with Proxmox Mail Gateway Proxmox Mail Gateway in the intranet Default port settings Alternative port settings (e.g. for MS Exchange) Proxmox Mail Gateway in DMZ (demilitarized zone) Proxmox Mail Gateway with multiple server and domains Performance tuning Hardware benchmarks Backup MX Blocking s on SMTP level Greylisting Sender Policy Framework SPF Real Time Blacklists (RBL) Local DNS RBL cache Spamhaus Datafeed Service Synchronize DNS blacklist to the Proxmox Mail Gateway Configure and start RBLDNS daemon Redirect DNS queries to local cache Receiver verification Proxmox Mail Gateway solutions Enabling verify receivers Settings for MS Exchange 2003 SP Settings for MS Exchange 2007 SP1 (and higher version) Rule system Default rules Blacklist Block viruses Virus alert Block dangerous files Modify header Whitelist Quarantine/Mark spam (Level 3) Custom rules Enable spam quarantine for just a selection of users Enable spam quarantine for existing LDAP users Block Spam s with a score higher BCC object a simple archive solution Block video and audio attachments Add admin notification to rules Proxmox Server Solutions GmbH 3 42

4 4.2.7 Block Video and Audio Attachments for LDAP groups Proxmox Mail Gateway HA cluster High availability Load Balancing with MX Records Multiple address records Using third party Firewall features Hardware selection and virtualization Physical Hardware Proxmox VE VMware Troubleshooting and technical support Table of figures Appendix Proxmox Server Solutions GmbH 4 42

5 1 Introduction The huge amount of traffic is a challenge for every environment. The daily routine brings along some major problems, this includes: performance, reliability, regulation under public law and threads like viruses or phishing attacks. is an essential service for any organization, and professionally managed improves organizational workflow and customer satisfaction. A missed could mean a lost opportunity, or it could cause a public-relations problem that no organization would want. How does the Proxmox Mail Gateway work? When an arrives at the Proxmox Mail Gateway, it is analyzed and forwarded to your server which is responsible for sending the to the receiver. If the server is not working, Proxmox Mail Gateway temporarily stores the message in the queue for later transfer. The process works similar for outgoing s. This document covers samples and deployment information how to integrate and customize Proxmox in your environment. Note: See also the Proxmox Mail Gateway Administration Guide for a detailed product description Proxmox Server Solutions GmbH 5 42

6 2 Proxmox Mail Gateway integration 2.1 system without Proxmox Mail Gateway In a sample configuration, your traffic (SMTP) arrives on the firewall and will be forwarded directly to your server. Figure 2-1 System without Proxmox Mail Gateway 2.2 system with Proxmox Mail Gateway A single Proxmox Mail Gateway Server can handle unlimited mail domains with multiple internal mail servers and millions of s per day. For high availability and maximum performance it is recommended to use a Proxmox Mail Gateway HA Cluster, see chapter 5 Proxmox Mail Gateway HA cluster High availability. Proxmox Mail Gateway can process incoming AND outgoing SMTP traffic by using different ports. One port is assigned to incoming, one port for outgoing s. With the integrated Proxmox Mail Gateway system all your traffic is forwarded to the Proxmox Mail Gateway which filters the whole traffic and removes unwanted s. You can manage incoming and outgoing traffic Proxmox Server Solutions GmbH 6 42

7 Figure 2-2 Incoming with Proxmox Mail Gateway Many mail filter solutions do not scan outgoing mails. Opposed to that Proxmox Mail Gateway is designed to scan both incoming and outgoing mails. This has two major advantages: Figure 2-3 Outgoing with Proxmox Mail Gateway 1. Proxmox Mail Gateway is able to detect viruses sent from an internal host. I many countries you are liable for not sending viruses to other people. Proxmox Mail Gateway outgoing scanning feature is an additional protection to avoid that. 2. Proxmox Mail Gateway can gather statistics about outgoing s too. Statistics about incoming s looks nice, but they are quite useless. Consider two users, user-1 receives 10 mails from news portals and wrote 1 mail to a person you never heard from. While user-2 receiver 5 mails from a customer and sent 5 mails back. Which user do you consider more active? I am sure its user-2, because he communicates with your customers. Proxmox Mail Gateway advanced address statistics can show you this important information. Solution which does not scan outgoing mail can t do that Proxmox Server Solutions GmbH 7 42

8 2.3 Proxmox Mail Gateway in the intranet Default port settings The default configuration of the Proxmox Mail Gateway uses port 25 for incoming and port 26 for outgoing s. Figure 2-4 Incoming default port settings (port 25) Outgoing Mails: Configure your mail server to send all s to the Proxmox Mail Gateway, port 26. Note: Proxmox Mail Gateway receives the outgoing s on port 26, so Proxmox Mail Gateway knows its internal trusted . After processing, Proxmox Mail Gateway sends the s to Internet, using standard port 25. Figure 2-5 Outgoing default port settings (port 26) Proxmox Server Solutions GmbH 8 42

9 2.3.2 Alternative port settings (e.g. for MS Exchange) Sometimes it is not possible to change the outgoing port due to third party software limitations or existing network configurations (e.g. changing MS Exchange to another sending port will have impact on Exchange internals and it s not recommend) To receive s you have to do port forwarding at your Firewall. So that you re external IP and port 25 shows to the Proxmox Mail Gateway IP and port 26. Figure 2-6 Incoming alternative port settings (port 26) With MS Exchange you should not use port 26 for outgoing so you have to switch these two values (25 and 26). In the end you have to use port 25 for outgoing and port 26 for incoming mails. Figure 2-7 Outgoing alternative port settings (port 25) Proxmox Server Solutions GmbH 9 42

10 2.4 Proxmox Mail Gateway in DMZ (demilitarized zone) To run a DMZ Zone you have to adjust your Firewall settings. The intranet (Local) and DMZ needs to have different IP Networks, for example: Interface Zone IP Address Net mask eth0 Local eth1 Internet eth2 DMZ Figure 2-8 Proxmox Mail Gateway in DMZ Proxmox Server Solutions GmbH 10 42

11 2.5 Proxmox Mail Gateway with multiple server and domains You can use Proxmox Mail Gateway sending s to different internal servers. For example you can send s addressed to domain.com to your first server, and s addressed to subdomain.domain.com to a second one. In the proxy transport section add the IP addresses or hostname, SMTP ports and mail domains of your additional servers. Figure 2-9 Multiple servers Note: you need for each domain an appropriate license, otherwise it will not work! Proxmox Server Solutions GmbH 11 42

12 3 Performance tuning 3.1 Hardware benchmarks Please use the command line tool proxperf to get an overview about your hardware and DNS performance. Note: Never run proxperf if the system is under load. Here is a sample output of proxperf : root@proxmox:~# proxperf CPU BOGOMIPS: REGEX/SECOND: HD SIZE: GB (/dev/disk/by-uuid/beca6e55-675d-4f11-bd74-eb93858d8fca) BUFFERED READS: MB/sec AVERAGE SEEK TIME: 0.95 ms FSYNCS/SECOND: DNS EXT: ms DNS INT: 1.72 ms (proxmox.com) Please compare your results against this reference. If you get lower results please analyze your hardware and DNS setup for comments post your results on Backup MX Using your ISPs server is not a good idea, because many ISPs do not use advanced spam prevention techniques. And spammers know this and they use your ISP backup MX to work around your Proxmox Mail Gateway spam filtering. Additionally, you can never benefit of blocking spam messages on SMTP level. If you need redundancy, it is recommended to run a second Proxmox Mail Gateway server in HA Cluster mode to avoid lower spam detection rates. 3.3 Blocking s on SMTP level Blocking s before they reach your network saves your internet bandwidth and reduces processing power. By doing the following, you can reduce your traffic by more than 90 %, depends on your environment. If you want to exclude some senders or receivers from getting blocked on the SMTP level, just enter them in the Mail proxy whitelist Proxmox Server Solutions GmbH 12 42

13 Figure 3-1 Mail proxy whitelist Greylisting Typically, a server that utilizes Greylisting will record the following three pieces of information (referred to as triplet) for all incoming . The IP address of the connecting host The envelope sender address The envelope recipient address The client is checked against the mail server's internal whitelists (if any) first. Then, if the triplet has never been seen before, it is greylisted for a period of time (how much time is dependent on the server configuration). The is rejected with a temporary error. The assumption is that since temporary failures are built into the RFC specifications for delivery, a legitimate server will attempt to connect again later on to deliver the . Greylisting is effective because many mass tools utilized by spammers are not set up to handle temporary failures (or any failures for that matter) so the Spam is never received. This feature can reduce traffic up to 50%. Greylisted s never reach your mail server and your mail server will stop sending useless "Non Delivery Reports" to spammers, filling up the queue. If a sender has a valid SPF record, he will never be greylisted Sender Policy Framework SPF Domains use public records (DNS) to direct requests for different services (web, , etc.) to the machines that perform those services. All domains already publish (MX) records to tell the world what machines receive for the domain. SPF works by domains publishing "reverse MX" records to tell the world what machines send for the domain. When receiving a message from a domain, the recipient can check those records to make sure is coming from where it should be coming from. Please make sure, that you deploy a valid SPF record for your mail domain. Note: see for setting up a SPF for your mail domain Proxmox Server Solutions GmbH 13 42

14 3.3.3 Real Time Blacklists (RBL) Proxmox Mail Gateway can use RBL checks on SMTP level to reject s. Therefore Proxmox Mail Gateway has to query the RBL servers for every SMTP connection. Multiple RBL providers can be added, but please make sure to follow the usage terms of the RBL provider. Well known providers are: Barracuda Reputation Block List BRBL Spamhaus Figure 3-2 Configure DNSBL Sites Proxmox Server Solutions GmbH 14 42

15 3.3.4 Local DNS RBL cache Spamhaus Datafeed Service Each leads to DNS queries to external RBL servers. If those servers are under heavy load, it cannot be guaranteed that you will get an answer. If you are running a high traffic site, it is also recommended to locally cache RBL data to avoid high traffic. Spamhaus offers a special datafeed service to download RBL data using rsync. Using that data, you can setup a local DNS service and thus reduce traffic to external DNS servers. Proxmox provides a script to synchronize those blacklists, and we also ship rbldnsd to easily setup a local DNS cache. Note: Spamhaus data feed is a commercial service additional license/account required. For details visit Synchronize DNS blacklist to the Proxmox Mail Gateway Local sync is done using the script proxblsync, usually started via cron. Please log in to the console and configure the following: crontab e 11,41 * * * * proxblsync --spamhaus eu.dr.spamhaus.net --mailto root Note: 11,41 stands for the minutes of each hour, please replace these values with the one in your spamhaus datafeed license. At present Spamhaus support three pools of servers: North America Europe Oceania and Southeast Asia na.dr.spamhaus.net eu.dr.spamhaus.net oc.dr.spamhaus.net Please choose the server pool that you believe to be closer (in terms of traveling times of Internet packets) to your geographical location Data is stored in /var/lib/rbldns/ after sucessful sync. In case of errors, a notification is sent to the address specified with the mailto attribute Configure and start RBLDNS daemon nano /etc/default/rbldnsd RBLDNSD="- -r/var/lib/rbldns -f -b \ sbl.spamhaus.org:ip4set:sbl \ pbl.spamhaus.org:ip4trie:pbl \ xbl.spamhaus.org:ip4tset:xbl \ zen.spamhaus.org:ip4set:sbl \ zen.spamhaus.org:ip4trie:pbl \ zen.spamhaus.org:ip4tset:xbl \ dbl.spamhaus.org:dnset:dbl" Proxmox Server Solutions GmbH 15 42

16 Then you can start the rbldnsd service: # /etc/init.d/rbldnsd restart Restarting rbldnsd: rbldnsd rbldnsd: listening on /53 rbldnsd: ip4set:sbl: : e32/24/16/8=539382/25617/439/0 rbldnsd: ip4trie:pbl: : ent= nodes= mem= rbldnsd: ip4tset:xbl: : cnt= rbldnsd: dnset:dbl: : e/w=702782/ rbldnsd: zones reloaded, time 3.71e/3.44u sec, mem arena=66564 free=136 mmap=63380 Kb rbldnsd: rbldnsd version 0.996b (29 Mar 2008) started (1 socket(s), 5 zone(s)) Redirect DNS queries to local cache Finally you need to reconfigure the bind9 service to redirect queries for spamhaus.org to rbldbsd : # nano /etc/bind/named.conf.local zone "spamhaus.org" { type forward; forward only; forwarders { port 53; }; }; Please restart the bind9 service to activate those changes: # /etc/init.d/bind9 restart Receiver verification Nowadays, domains are receiving a lot of s to non-existing users. This could be up to 95 % of junk messages. In short, this means for your systems: Increased traffic on your internet connection Your server is handling junk s instead of working for you High load on your scanners Slow overall performance and high costs Proxmox Mail Gateway solutions Proxmox Mail Gateway can detect these s to non-existing users on SMTP level, which means BEFORE the s are transferred to your networks. In short, this means for your systems: Reduced traffic, up to 90 % Proxmox Server Solutions GmbH 16 42

17 Your internal server is now working for you again Reduced load on your scanners, 90 % less s to analyze for spam and viruses Good performance and costs Proxmox Server Solutions GmbH 17 42

18 Enabling verify receivers You can enable this option on the admin interface (Configuration/Mail Proxy/Options) We recommend selecting yes (450). 450 means, that in the case of a short downtime of your internal mail server no messages are lost. Note: Your internal server has to be reconfigured to reject unknown user. Proxmox Mail Gateway is doing a short query to the internal server to check if the user is valid. For settings on Exchange 2003 SP2, see chapter Settings for MS Exchange 2003 SP2 Figure 3-3 Enable Verify Receivers Proxmox Server Solutions GmbH 18 42

19 Settings for MS Exchange 2003 SP2 You have to enable Recipient Filtering, please use the Exchange System Manager. Figure 3-4 Exchange 2003: Filter recipients Proxmox Server Solutions GmbH 19 42

20 Figure 3-5 Exchange 2003: Filter recipients Proxmox Server Solutions GmbH 20 42

21 Figure 3-6 Exchange 2003: Filter recipients 3 Figure 3-7 Exchange 2003: Filter recipients Proxmox Server Solutions GmbH 21 42

22 Settings for MS Exchange 2007 SP1 (and higher version) First, make sure that you have the MS Exchange 2007 Anti-Spam agent. If you installed a typical one server installation, this is NOT installed by default. Microsoft provides an install script to manually install the Anti-Spam agent: 1. Open the Exchange Management Shell 2. cd c:\program files\microsoft\exchange Server\Scripts 3..\install-AntispamAgents 4. Restart the Microsoft Exchange Transport service Figure 3-8 MS Exchange 2007 SP1: Install Anti-Spam agent Now you can enable Recipient Filtering on the Anti-Spam agent, please use the MS Exchange Management Console Proxmox Server Solutions GmbH 22 42

23 Figure 3-9 MS Exchange 2007 SP1: Filter recipients 1 Figure 3-10 MS Exchange 2007 SP1: Filter recipients Proxmox Server Solutions GmbH 23 42

24 4 Rule system The object-oriented rule system enables custom rules for your domains. It s an easy but very powerful way to define filter rules by user, domains, time frame, content type and resulting action. Who - object For TO and/or FROM Category Example: Mail object - Who is the sender or receiver of the ? When - object Example: When is the received by Proxmox Mail Gateway? What - object Example: Does the contain spam? Action - object Example: Mark with "SPAM:" in the subject. Every rule has got 5 categories (FROM, TO, WHEN, WHAT, ACTION) which can contain several objects. For example enable Archive Solutions with BCC Object (Blind carbon copy, recipients not visible in the "To" field) to Mailbox or to a Public Folder FROM: Anybody TO: Anybody WHEN: Always WHAT: Mail ACTION: BCC to Publicfolder In most of the countries worldwide a company has to forward all s to their employees this includes spam s as well. For example to send Spam s in quarantine FROM: Anybody TO: Anybody WHEN: Always WHAT: Spam ACTION: Quarantine With this kind of setup the receiver gets detailed Information about the Spam s. Quarantine can be enabled just for existing LDAP groups or via BCC to Public Folders or Mailboxes. At present the usefulness of is being threatened by three phenomena: spamming, phishing and worms. Spamming is unsolicited commercial . Because of the very low cost of sending , spammers can send hundreds of millions of messages each day over an inexpensive internet connection. Hundreds of active spammers sending this volume of mail results in information overload for many computer users who receive tens or even hundreds of junk messages each day. worms use as a way of replicating themselves into vulnerable computers. The combination of spam and worm programs results in users receiving a constant drizzle of junk e- mail, which reduces the usefulness of as a practical tool Proxmox Server Solutions GmbH 24 42

25 To increase the efficiency of communications the use of anti-spam, anti-phishing and antivirus software is essential. With the deployment of Proxmox Mail Gateway you get the job done. Based on the design as software appliance one of the strengths of Proxmox Mail Gateway is its flexibility. It can be easy integrated in existing architecture. It s compatible to every type of mail server or MTA (e.g. MS Exchange, Lotus Domino, Postfix ). For example a virus protection looks like this: FROM: Anybody TO: Anybody WHEN: Always WHAT: Virus ACTION: Block (or Quarantine) Options range from simple spam and virus filter setups to sophisticated, highly customized configurations blocking certain types of s and generating notifications Proxmox Server Solutions GmbH 25 42

26 4.1 Default rules Blacklist This rule blocks all s received from the senders listed in the Blacklist. The Blacklist can contain several items. (Please note, the term Blacklist is widely used in industry and it s not meant as racist.) Figure 4-1 Rule: Blacklist Figure 4-2 Who Object: Blacklist Block viruses This rule quarantines all incoming virus and informs the admin via notification Proxmox Server Solutions GmbH 26 42

27 4.1.3 Virus alert Figure 4-3 Rule: Block Viruses This rule blocks all outgoing virus and informs the admin and sender via notification. Figure 4-4 Rule: Virus Alert Block dangerous files This rule removes dangerous attachments from incoming s (.vbs,.bat,.com, ) Proxmox Server Solutions GmbH 27 42

28 4.1.5 Modify header Figure 4-5 Rule: Block Dangerous Files This rule modifies header for all incoming e- . It just adds the results of the spam analysis, including the test names and the reached spam score. Figure 4-6 Rule: Modify Header Proxmox Server Solutions GmbH 28 42

29 4.1.6 Whitelist This rule accepts all s received from the senders listed in the Whitelist. The Whitelist can contain several items. (Please note, the term Whitelist is widely used in industry and it s not meant as racist.) Figure 4-7 Rule: Whitelist Figure 4-8 Who Object: Whitelist Quarantine/Mark spam (Level 3) This rule identifies Spam with Level 3 and modifies the subject and move the to the spam quarantine Proxmox Server Solutions GmbH 29 42

30 Figure 4-9 Rule: Quarantine/Mark Spam (Level 3) Proxmox Server Solutions GmbH 30 42

31 4.2 Custom rules Proxmox Mail Gateway provides samples for custom rules to show the functionality. For support or help configuring rules the Proxmox support forum at or submit a support request via the Proxmox Customer Portal at Enable spam quarantine for just a selection of users If you want to use the spam quarantine for specific users or a specific domain (and for the rest just Mark Spam ), create a new WHO object containing these users or domains. 1. Create a new WHO object; give a name like Quarantine Users and add the users or domains to this object 2. Use the existing (inactive) rule Spam Quarantine and set higher priority than the Mark Spam rule (e.g. 81) 3. Add the WHO object Quarantine Users 4. Activate the rule Figure 4-10 Enable Spam quarantine for just a selection of users Proxmox Server Solutions GmbH 31 42

32 4.2.2 Enable spam quarantine for existing LDAP users If you want to use the spam quarantine only for existing internal addresses, you can use the LDAP query Existing LDAP. 1. Create a new WHO object; give a name like Existing LDAP address and add the LDAP group Existing LDAP address 2. Use the existing (inactive) rule Spam Quarantine and set higher priority than the Mark Spam rule (e.g. 81) 3. Add the WHO object Existing LDAP address 4. Activate the rule Figure 4-11 Create WHO object Existing LDAP address Figure 4-12 Enable Spam quarantine for existing LDAP addresses Proxmox Server Solutions GmbH 32 42

33 4.2.3 Block Spam s with a score higher 10 The default rule moves Spam with a score higher 3 to the spam quarantine. By activating this additional rule, you can block Spam with a score higher 10 to reduce the delivery of spam s to the user spam quarantine Figure 4-13 Activate Block Spam (Level 10) BCC object a simple archive solution If you need to archive s it s useful to send a copy to a special mailbox. If you have Microsoft Exchange, you can also send a copy to a enabled public folder. 1. Create an Action Object: Add BCC Object, name it BCC to Archive Public folder or Mailbox 2. Under Receiver, type the address of the public folder/mailbox 3. Click on an already existing rule or create a new one 4. Add Action Object BCC to Archive Public folder or Mailbox to the rule How to create a Mail Enable Public Folder under MS Exchange 2000/2003? 1. Create a public folder in MS Exchange (MS Exchange System Manager or via Outlook) 2. "Mail enable" the public folder via MS Exchange system manager right click an select Mail Enable 3. Wait a few minutes, MS Exchange creates the address 4. Right click the folder an check the address (or change it, if you want), remember address 5. Set appropriate client permission (note: anonymous must have the right to create items) 6. Optional: Set age limit: select Limits and set the age limit to 90 days (all messages older than 90 days will be automatically deleted) Proxmox Server Solutions GmbH 33 42

34 Block video and audio attachments 1. Create a new rule, e.g. Block Multimedia Files, define direction and set priority 2. Add What Object Multimedia to the rule 3. Add Action Object Block to the rule 4. Final review (still inactive) 5. Activate the rule Add admin notification to rules If you block mails it s useful to inform the Proxmox Mail Gateway Admin Click on the desired rule 2. Add the notify Admin action to the rule Block Video and Audio Attachments for LDAP groups The LDAP groups can be used to apply special settings to groups. Most people like sending joke videos and audio files via this grows up your users mailboxes. On the other side, you do not want to block these funny things for everybody. We assume you have a MS ADS group called Staff (including all your active users) Create a new WHO Object, give a name, e.g. Staff Add LDAP Group to the Object, select your LDAP Profile and select Staff from the dropdown menu, click save. Now you can test your object against addresses Add new rule, give a name, e.g. Block Multimedia for Staff, set priority to 70, set direction to in, click save Add the WHO object Staff from above to the rule (as to ) Add the WHAT Multimedia to the rule Add the ACTION object Remove Attachments Final review (still inactive) Activate the rule Note: Removed attachments from s are replaced with a text file Proxmox Server Solutions GmbH 34 42

35 Figure 4-14 Block video and Audio attachment for LDAP group Staff Proxmox Server Solutions GmbH 35 42

36 5 Proxmox Mail Gateway HA cluster High availability We are living in a world where becomes more and more important - failures in systems are just not acceptable. To meet these requirements we developed the Proxmox Mail Gateway HA (High Availability) Cluster. The Proxmox Mail Gateway HA Cluster consists of a master and several nodes (minimum one maser and one node). Configuration is done on the master. Configuration and data is synchronized to all cluster nodes over a VPN tunnel. This provides the following advantages: centralized configuration management fully redundant data storage high availability high performance Proxmox Mail Gateway uses a unique application level clustering scheme, which provides extremely good performance. Special considerations where taken to make management as easy as possible. Complete Cluster setup is done within minutes, and nodes automatically reintegrate after temporary failures without any operator interaction. Figure 5-1 Proxmox Mail Gateway HA Cluster with load balanced MX records Proxmox Server Solutions GmbH 36 42

37 5.1 Load Balancing with MX Records It s quite simple to set up a high performance load balanced mail cluster using MX records. You have to define two MX records with the same priority. You need to have 2 working Proxmox Mail Gateways (mail1.example.com and mail2.example.com), each having its own IP address (the rest of the setting should be more or less equal, i.e. you can use backup/restore to copy the rules). We recommend adding reverse lookup entries (PTR records) for those hosts. Many systems nowadays reject mails from hosts without valid PTR records. This is all you need. You will receive mails on both hosts, more or less load-balanced (round-robin scheduling). If one host fails the other is used. Figure 5-2 Load balancing via MX Records Proxmox Server Solutions GmbH 37 42

38 5.2 Multiple address records Using several DNS MX record is sometime clumsy if you have many domains. It is also possible to use one MX record per domain, but multiple address records: Figure 5-3 Load balancing Multiple Address Records 5.3 Using third party Firewall features Many firewalls can do some kind of RR-Scheduling (round-robin) when using DNAT. See your firewall manual for more details Proxmox Server Solutions GmbH 38 42

39 6 Hardware selection and virtualization Proxmox Mail Gateway always needs a dedicated PC or server hardware. Alternative, Proxmox Mail Gateway can be run under the following virtualization technologies: Proxmox VE (KVM) VMware vsphere (VMware tools are integrated in the ISO) Hyper-V (Hyper-V Linux integration tools are integrated in the ISO) KVM (virtio drivers are integrated, great performance) Virtual box Citrix XenServer 6.1 Physical Hardware See for hardware recommendation or contact us via the Proxmox Customer Portal at For maximum performance we recommend: Hard disks CPU RAM Enterprise class SSD with power loss protection (e.g. Intel SSD DC 35xx/36xx/37xx) Two physical CPU with a lot of cores (e.g. Intel Xeon) 4 GB ECC 6.2 Proxmox VE The Proxmox Mail Gateway runs perfectly on qemu/kvm. Just install from ISO, use virtio for disk and network. 6.3 VMware Proxmox Mail Gateway runs perfectly under VMware. Proxmox Mail Gateway 4.x ISO installer includes open-vm tools by default. Just install from ISO Proxmox Server Solutions GmbH 39 42

40 7 Troubleshooting and technical support Use the moderated Proxmox support forum or contact us via the Proxmox Customer Portal at All information: Proxmox Server Solutions GmbH 40 42

41 8 Table of figures Figure 2-1 System without Proxmox Mail Gateway... 6 Figure 2-2 Incoming with Proxmox Mail Gateway... 7 Figure 2-3 Outgoing with Proxmox Mail Gateway... 7 Figure 2-4 Incoming default port settings (port 25)... 8 Figure 2-5 Outgoing default port settings (port 26)... 8 Figure 2-6 Incoming alternative port settings (port 26)... 9 Figure 2-7 Outgoing alternative port settings (port 25)... 9 Figure 2-8 Proxmox Mail Gateway in DMZ Figure 2-9 Multiple servers Figure 3-1 Mail proxy whitelist Figure 3-2 Configure DNSBL Sites Figure 3-3 Enable Verify Receivers Figure 3-4 Exchange 2003: Filter recipients Figure 3-5 Exchange 2003: Filter recipients Figure 3-6 Exchange 2003: Filter recipients Figure 3-7 Exchange 2003: Filter recipients Figure 3-8 MS Exchange 2007 SP1: Install Anti-Spam agent Figure 3-9 MS Exchange 2007 SP1: Filter recipients Figure 3-10 MS Exchange 2007 SP1: Filter recipients Figure 4-1 Rule: Blacklist Figure 4-2 Who Object: Blacklist Figure 4-3 Rule: Block Viruses Figure 4-4 Rule: Virus Alert Figure 4-5 Rule: Block Dangerous Files Figure 4-6 Rule: Modify Header Figure 4-7 Rule: Whitelist Figure 4-8 Who Object: Whitelist Figure 4-9 Rule: Quarantine/Mark Spam (Level 3) Figure 4-10 Enable Spam quarantine for just a selection of users Figure 4-11 Create WHO object Existing LDAP address Figure 4-12 Enable Spam quarantine for existing LDAP addresses Figure 4-13 Activate Block Spam (Level 10) Figure 4-14 Block video and Audio attachment for LDAP group Staff Figure 5-1 Proxmox Mail Gateway HA Cluster with load balanced MX records Figure 5-2 Load balancing via MX Records Figure 5-3 Load balancing Multiple Address Records Proxmox Server Solutions GmbH 41 42

42 9 Appendix Reference document: Mail Gateway AdminGuide You can download the latest version from - End of document Proxmox Server Solutions GmbH 42 42