I don’t think I was clear in my post and I’m a little confused by your response. Rather than take the inbound traffic on the vps and proxy it over to the mailu server, I’d like to NAT (masquerade) that traffic so that source IP reports the actual source.
Comment on Retain source IP when proxying through VPS
themoonisacheese@sh.itjust.works 1 year ago
Not really. Your VPS’s public IP is not yours to change, for obvious reasons, and it’s unlikely that your hosting provider will let you send packets from your VPS using a source address that is incorrect. if they let you, then any replies to those packets will evidently get routed to the actual IP, ie your home IP. If you really want to forward SMTP to your VPS (which has less chance of being on a Blocklist by virtue of not being a residential IP), I suggest declaring your VPS as your SMTP sender in SPF, instead of declaring your home IP and trying to make that work with the VPS IP. The VPS can then be configured as an SMTP relay (this is a key feature of SMTP) to your home instance, or you could forward all traffic on the appropriate ports at the TCP level, but I don’t advise doing this.
I hope you understand that if what you’re asking was possible, I could rent a VPS, spoof your IP and receive traffic meant for your IP without any issues. For the same reasons, I think the other commenter mentioning x-forwarded-for headers is wrong if you’re not using DKIM (and even then it’s iffy). Otherwise I could just write a payload with mailto: whatever, from:you@yourdomain and x-forwarded-for: your home IP and pass SPF checks without having control over your IP.
if you’re still confused about SMTP feel free to ask more questions
SeeJayEmm@lemmy.procrastinati.org 1 year ago
themoonisacheese@sh.itjust.works 1 year ago
So to be clear, you want traffic coming out of your VPS to have a source address that is your home IP?
let’s go back to fundamentals and assume for a second that your VPS provider allows these packets out and your VPS initiates a TCP connection like that. It sends a TCP SYN with source: home address and dest: remote.
The packet gets routed to the remote. The remote accepts and responds SYN/ACK with source: remote and dest: home address.
Where do you think this packet will get routed? When it gets there, do you think the receiving server (and NAT gateways in between) will accept this random SYN/ACK that doesn’t appear to have a corresponding outgoing packets sent first? If so, how?
adam@doomscroll.n8e.dev 1 year ago
So to be clear, you want traffic coming out of your VPS to have a source address that is your home IP?
No that’s not how I read it at all. He wants his VPS to act as a NAT router for email that routes traffic through a wireguard tunnel to the mail server on his home network. His mail server would act as if it was port forwarded using his home router, only it won’t be his home IP, it’ll be the VPS’s
ninjan@lemmy.mildgrim.com 1 year ago
We have more stuff than SPF checks these days because they’re wholely inadequate alone. DNSSEC, DKIM and DMARC are all important in their own right if you want a secure mail server.
That said I also don’t agree with your example, because you assume a proxy for outgoing which I see no real need for. Generally speaking you proxy incoming traffic due to CGNAT making port exposure on a residential IP unfeasible. Further SPF checks will always use the actual IP source not what’s in a X header.
themoonisacheese@sh.itjust.works 1 year ago
You need a proxy for outgoing to avoid your source server being on a residential adress, which all but guarantees all mailservers using spamhaus etc will block you by default. DKIM and DMARC are needed in their own right but an SPF fail will already make your mail fall into spam.
ninjan@lemmy.mildgrim.com 1 year ago
Sure, but if you proxy both in and outgoing then your SPF record should of course point to your VPS and thus again not be a problem.
themoonisacheese@sh.itjust.works 1 year ago
Indeed, but in that case an off-the-shelf SMTP relay works fine.