Re: [gentoo-user] Mail forwarder on LAN

[Grant Taylor]

On 12/23/18 7:03 PM, Daniel Frey wrote:
> This is correct. A is the voice vlan, the black box is the phone server
> (which I am unable to add custom routes or new software packages to), B
> is another vlan that has access through site-to-site vpn to C.

That makes perfect sense.  There is functionally zero hope of modifying 
the phone system.  Even if you could, it would likely compromise 
warranty, other complications ensue.  Let's just consider this a no-fly 
zone.

> A needs to send to a mail server on C but it isn't a part of the
> addressing required to traverse through the vpn.

Yep.  A LOT of VPNs decide what traffic is interesting and / or allow 
traffic based on source and / or destination subnet.

> Hence my thought of a mail forwarder.

Can the phone server in A talk to a system in B?  Or does the magic need 
to happen on a multi-homed host that is in both the Voice VLAN (A) and 
data VLAN (B)?

> I've never had to deal with a server in this manner before... needing to
> go through a different vlan/vpn. Hence my thought of a mail relay.

I believe the mail relay, particularly if it's multi-homed in both voice 
and data VLANs, is a viable option.

> I was messing with source and destination nat but because of the site
> vpn addressing, and the phone server not being in that address range...
> I'm pretty sure that's why it wasn't working.

Depending where you do it, I would expect that the NAT would work.

Hypothetical scenario:

Voice VLAN = 192.0.2.0/24
Local Data VLAN = 198.51.100.0/24
Remote Data VLAN = 203.0.113.0/24

I'm guessing that you need to get voice messages as attachments from the 
VoIP PBX, 192.0.2.123, to the corporate email server, 203.0.113.234. 
The problem is the site-to-site VPN only allows 198.51.100.0/24 and 
203.0.113.0/24 to communicate.  Meaning that the site-to-site VPN won't 
pass traffic from the VoIP PBX.

Here's an important question:  Does the VoIP PBX have a default gateway 
configured?  Or does it /only/ know about the voice VLAN, 192.0.2.0/24? 
Because if it doesn't have a default gateway, then (what it knows as) 
the mail server will have to be local to the voice subnet.

We already know that the local side of the email solution will have to 
be in the 198.51.100.0/24 subnet to bee able to use the VPN.

You could probably fairly easily have a multi-homed host that is in both 
the Voice VLAN, 192.0.2.252, and the Local Data VLAN, 198.51.100.252.

That would allow you to run an MTA on the multi-homed host and forward 
email at the SMTP application layer.

That would also allow you to use NAT to translate the SMTP traffic as it 
passes between the VoIP PBX and the corporate email server.

Let's say that eth0 is in the Voice VLAN, 192.0.2.252, and that eth1 is 
in the Local Data VLAN, 198.51.100.252.

# Traffic from the VoIP PBX to the corporate email server.
iptables -t nat -A PREROUTING -i eth0 -s $PBXIP -d 192.0.2.252 -p tcp 
--dport 25 -j DNAT 203.0.113.234
iptables -t nat -A POSTROUTING -o eth1 -s $PBXIP -d 203.0.113.234 -p tcp 
--dport 25 -j SNAT 198.51.100.252

# Traffic from the corporate email server to the VoIP PBX.
iptables -t nat -A PREROUTING -i eth1 -s 203.0.113.234 -d 198.51.100.252 
-p tcp --sport 25 -j DNAT $PBXIP
iptables -t nat -A POSTROUTING -o eth0 -s 203.0.113.234 -d $PBXIP -p tcp 
--sport 25 -j SNAT 192.0.2.252

That should get quite close to what you need.  That alters both the 
source and destination IP addresses as the traffic passes through the 
multi-homed host, in each direction.

Aside:  I call that "Double NAT" because it NATs two different addresses 
on one device (as two distinct operations).  But the rest of the world 
thinks "Double NAT" is something else.  :-/