Topic: Allow open relay from one LAN address

[charlien]

I need to allow my SME server to be an open relay for one IP address on our LAN. I want to make sure what I do will not open things up to the world. Can someone give me so direction. I'd appreciate it. To explain a little more, we have installed a voice mail that will send email notification to a user that there is a voice mail in there voicemail box. That server requires the use of an open relay. All the the intended recipients have mailboxes on the SME server (if that helps). The voice mail does not have any option for authentication on the SME server. I can only input the IP address of the SME box. 

[David Harper]

Try this:

Code: [Select]

config setprop qpsmtpd Authentication disabled
signal-event email-update

AFAIK this will disable authentication for all LAN clients, but still not enable SMTP access to WAN clients. But I would do some testing just in case

[charlien]

"but still not enable SMTP access to WAN clients"

I'm not sure what that means. We allow ssl WAN access to our server so smartphone users can send/recieve email.

[David Harper]

As far as I know altering the authentication settings will not affect this functionality - but do make sure to test the changes.

[charlien]

Thanks David. I'm paranoid about becoming and open relay and wanted to bounce this off someone more knowledgeable than me. I will test it.

[David Harper]

Let us know how you get along. AFAIK incoming WAN SMTP requests are blocked by the firewall, although SSMTP is allowed.

In the end, if it doesn't work, reverse the change as shown:

Code: [Select]

config setprop qpsmtpd Authentication enabled
signal-event email-update

... and we will put our thinking caps on.

[CharlieBrady]

Let us know how you get along. AFAIK incoming WAN SMTP requests are blocked by the firewall, although SSMTP is allowed.

No, incoming WAN SMTP is permitted - that's how email addressed to your domain arrives. Mail relaying, however, is not permitted from the WAN connection, i.e. mail for other domains is not accepted.

[David Harper]

Ah, that makes sense