2 - Raspberry PI Community Projects

11.1.3.1. IP-Based Access Restrictions
The smtpd_client_restrictions directive controls which machines are allowed to communicate
with the email server.
smtpd_client_restrictions = permit_mynetworks,
warn_if_reject reject_unknown_client,
check_client_access hash:/etc/postfix/access_clientip,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client list.dsbl.org
Example 11.6
Restrictions Based on Client Address
When a variable contains a list of rules, as in the example above, these rules are evaluated in
order, from the first to the last. Each rule can accept the message, reject it, or leave the decision
to a following rule. As a consequence, order matters, and simply switching two rules can lead
to a widely different behavior.
The permit_mynetworks directive, used as the first rule, accepts all emails coming from a machine
in the local network (as defined by the mynetworks configuration variable).
The second directive would normally reject emails coming from machines without a completely
valid DNS configuration. Such a valid configuration means that the IP address can be resolved to
a name, and that this name, in turn, resolves to the IP address. This restriction is often too strict,
since many email servers do not have a reverse DNS for their IP address. This explains why the
Falcot administrators prepended the warn_if_reject modifier to the reject_unknown_client
directive: this modifier turns the rejection into a simple warning recorded in the logs. The
administrators can then keep an eye on the number of messages that would be rejected if the
rule were actually enforced, and make an informed decision later if they wish to enable such
enforcement.
TIP
access tables
The restriction criteria include administrator-modifiable tables listing combinations
of senders, IP addresses, and allowed or forbidden hostnames. These
tables can be created from an uncompressed copy of the /usr/share/doc/
postfix-doc/examples/access.gz file. This model is self-documented in its
comments, which means each table describes its own syntax.
The /etc/postfix/access_clientip table lists IP addresses and networks;
/etc/postfix/access_helo lists domain names; /etc/postfix/access_
sender contains sender email addresses. All these files need to be turned into
hash-tables (a format optimized for fast access) aer each change, with the
postmap /etc/postfix/file command.
The third directive allows the administrator to set up a black list and a white list of email servers,
stored in the /etc/postfix/access_clientip file. Servers in the white list are considered as
trusted, and the emails coming from there therefore do not go through the following filtering
rules.
258 The Debian Administrator's Handbook