This setup enables pfSense to load balance traffic from your LAN to multiple internet connections (WANs). Traffic from the LAN is shared out on a round robin basis across the available WANs. pfSense monitors each WAN connection, using an IP address you provide, and if the monitor fails, a failover configuration is used, this typically just feeds all traffic down the other connection(s). This example sets up 2 WANs, but 3 or more can be used.
2/Intro
You can use other device load balance but it very expensive for your Company (Include My company).Pfsense can deploy all company from small -> big company( <500users)
3/Install
you can Setup pfsense with 3 interface
Lan:172.16.1.1
Wan1: 192.168.20.204
Wan2:172.16.10.1
Step 1: Create App pool wan1&wan2(services>load balancer)
Step 2:Create rule for Local access internet via poolwan1&wan2 Step 3:Check status pool (Status > Load Balancer)
Step 4:Disconnect line 1 check internet va status pool
Step 4:Connect Line 1 Disconnect line 2 check internet va status pool other you can setup Pfsense cluster failover .I will intro later
This article walks through the setup for a email gateway for multiple domains, rejects unknown email addresses, and uses a script to query valid email addresses via Active Directory.
Overview
This article describes the rationale and the setup of an external email firewall/gateway server with Postfix, a secure, high performance, and easily configurable alternative SMTP server to Sendmail.
The most common reason for this is to improve security (this applies even if you're not running Exchange). Since the email gateway theoretically only exposes its SMTP port, and will not store any emails, so even in the (ideally unlikely) event that it is compromised, any sensitive or valuable data is held elsewhere. The worst that could happen is that the attacker obtains a list of vaild email addresses for your domain(s). It can also be used for offloading services from your main email server, tasks like rejecting and filtering spam, greylisting, scanning viruses, avoiding unnecessary bandwidth, etc.
There are "articles" on the Internet that make references to simplying using the "relayhost = internalsmtp.test.vn" directive. The problem with this setup is that since the external email gateway knows nothing about the internal addresses (even when configured to only accept email to @test.vn), that it has to accept and forward everything and depend on the internal host to handle rejecting and bouncing messages. This might be acceptable, except if/when your domain becomes the target of a flood of spam or viruses to invalid/generated email addresses. Especially since the source and reply-to addresses of these emails are typically spoofed, each message ends up being accepted at the email gateway, forwarded to your internal server, rejected and relayed back to your email gateway, queued by the email gateway for delivery, retried repeatedly until it exceeds the nominal timeout, then bounced back to the email admin account on your internal email server. Lather, rinse and repeat that for every single message and it should be clear why you should never just use the "relayhost" directive to do this.
The "correct(tm)" way to do this, is to set up the email gateway so that it has knowledge of valid email addresses. That way, any address that doesn't exist is immediately rejected before the email gateway even gets to accept the data. This is important enough to worth being redudant. Rejecting unknown addresses not only avoids the whole loop described above, but avoids tying up your bandwidth receiving whatever data that would have been sent.
References / Links
Basically, this article is a restatement of Postfix email firewall/gateway found on Postfix.org's online configuration examples
Configuration
This article will not cover the compiling or installation of Postfix as it's generally available or easily installed for most distributions.
/etc/postfix/main.cf
As the name implies, this is the main configuration file for Postfix. One main attribute with Postfix is that the defaults generally default to something sensible, so that for the most part, outside of the parameters that need to be customized to your setup, they can be completely omitted in main.cf.
Hint: The command below will show the configuration directives that have been altered from default.
postconf -n
Since this is an email gateway only meant to forward email, disable local mail delivery by (Note: setting a configuration directive to empty disables it):
mydestination = local_recipient_maps = local_transport = error:local mail delivery is disabled
Normally, emails that originate from a host will have a from address in the form of username@hostname.test.vn. However, since the email gateway cannot receive mail for local users (as disabled above), you need to set the originating domain to something sensible:
myorigin = test.vn
mynetworks = define which networks are allowed to relay mail through this host. Although it's meant for internal networks to be able to relay mail without having to authenticate, it can be used (abused) to include external IP addresses or networks. However, the proper solution is to set up your Postfix installation to do SASL authentication:
mynetworks = 127.0.0.0/8, 192.168.20.0/24
This section below prevents addresses such as usernexame@subdomain.test.vn to match. Explicitly define domains you wish to accept using relay_domains below.
transport_maps = holds the mappings between domains and the SMTP server where the mail gets forwarded. See /etc/postfix/transport for details.
transport_maps = hash:/etc/postfix/transport
relay_recipient_maps = points to a file that lists all of the email addresses for which the email gateway will accept mail. See /etc/postfix/relay_recipients.
show_user_unknown_table_name = controls whether Postfix returns "User unknown in relay recipient table" (default - useful for debugging only) or "User unknown" (when set to no). This configuration directive is only used in conjunction with relay_recipient_maps.
show_user_unknown_table_name = no
ven though local mail delivery is disabled, the email gateway is still supposed to accept emails to postmaster and abuse. To do so, define a virtual alias map (we'll populate the values later). See /etc/postfix/virtual for details.
virtual_alias_maps = hash:/etc/postfix/virtual
/etc/postfix/master.cf
This file basically defines services that Postfix will provide. To completely disable local mail delivery, edit /etc/postfix/master.cf and insert a # symbol in front of the local service definition:
#local unix - n n - - local
/etc/postfix/virtual
In a typical setup, /etc/aliases is used to forward mail to other account or external addresses. However, since local mail delivery is disabled, modifying /etc/aliases has no effect. This file holds the alias mappings between local addresses and actual email addresses. Note: this is only necessary because there is no local mail delivery, and that some "local" addresses ought to exist for technical correctness.
Actually, you can use this file for more than local addresses. You can forward emails from ex-users to their new emails addresses, create simple distribution lists, or copy an email to another user, etc.
This file folds a complete list of email address for which the email gateway will accept mail. Even though you have to enter the values as a pair (key & value), the second part (the value) doesn't actually matter as long as the email addresses are correct.
user1@test1.vn OK user2@test1.vn OK user1@test2.vn OK user2@test2.vn OK user1@subdomain.test.vn OK user2@subdomain.test.vn OK
Populating relay_recipients from Active Directory
Note that this script requires perl and Net::LDAP(you need install perl-ldap by yum). However, this does NOT have to be on your email gateway.
Shorewall (more appropriately the Shoreline Firewall) is an open sourcefirewall tool for Linux that builds upon the Netfilter (iptables/ipchains) system built into the Linux kernel, making it easier to manage more complex configuration schemes.
Using an analogy understandable to programmers: Shorewall is to iptables, what C is to assembly language. It provides a higher level of abstraction for describing rules using text files.
II/INSTALL
1/ download all packages *.rpm of shorewall(http://rpm.pbone.net/ if You use Fedora can use yum ) and install with command rpm -ivh *.rpm
2/Configure Shorewall
I Configure shorewall with 3 interface and 3 zone:net,DMZ,Local
2.1/in file /etc/shorewall/zone add all lines
fw firewall net ipv4 # loc ipv4 #
dmz ipv4 #
2.2/ In file /etc/shorewall/interfaces add all lines
net eth1 #interface of zone net
loc eth0 # interface of Zone loc
dmz eth2 #interface of Zone dmz 2.3/In File /etc/shorewall/masq add all lines (This file use for NAT outbound)
This guide will show you how to integrate Active Directory/LDAP into Postfix and Dovecot. In this page, you will learn how to enable Postfix to lookup email addresses in LDAP and how to enable Dovecot to authenticate to an LDAP server.
We will be using the following attributes
samaccountname or uid – User Name for Active Directory or OpenLDAP respectively.
mail – Email Address. For Active Directory users, you need to fill-up the E-mail field of the User.
othermailbox – For Active Directory only. We will use this field to store email aliases. Use ADSI Edit to update this field.
Create the Virtual Mail User Account
Since the Active Directory/OpenLDAP user names are not part of the Linux system, we will have to create a user that will be the owner for all the files belonging to the LDAP user names.
1. Create a new user, we will call it vmail. Change the Login Shell to /sbin/nologin, this user account should not be used for logging in.
2. Take note of the User ID and Home Directory of vmail(example 502).
3. Now note down the Group ID of vmail. We’ll be needing all of them later.
Postfix Active Directory/LDAP Integration
1. Create the file /etc/postfix/ldap-users.cf containing the lines below
server_host = dc.test.vn search_base = dc=test,dc=vn version = 3 query_filter = (&(objectclass=person)(mail=%s)) result_attribute = samaccountname #Account from DC result_format = %s/Maildir/
If you are connecting to an Active Directory server and would like to have email alias capability, change the query filter to (&(objectclass=person)(|(mail=%s)(othermailbox=%s))) to include the othermailbox field in the search.
Change samaccountname to uid if you will be connecting to an Active Directory server. If your server requires authentication, add the lines below
virtual_mailbox_base, virtual_uid_maps and virtual_gid_maps should contain the home directory, user id and group id of vmail respectively.
Make sure $mydomain in mydestination has been removed, otherwise the lookup will not work and you will get a “User unknown in local recipient table” error.
4. Restart the Postfix
5. You should now be able to send email to addresses found in your LDAP server. sing LDAP email addresses instead of the system user names.
Dovecot Active Directory/LDAP Integration
1. Create the file /etc/dovecot-ldap.conf containing the lines below
pfSense is a FreeBSD-based firewall tailored for use as a firewall and router. The project started in 2004 as a fork of the m0n0wall project, but focused towards full PC installations rather than the embedded hardware focus of m0n0wall.
Common Deployments
Although mainly deployed as a perimeter firewall, pfSense is versatile enough to fill many types of deployments. Here is a short list of common deployments:
Perimeter Firewall - As discused earlier, this is by far the most common deployment for pfSense.
Router - Due to the ability to load balance connections and provide failover capabilities, pfSense makes for an ideal choice for a DIY Router for the SMB market.
Wireless Access Point - With the ability of Captive Portal within it, pfSense can easily be deployed as a wireless hotspot solution.
Special purpose appliance - Some users have decided to utilize pfSense in a unique way to helpfulfill their unique needs.
VPN Appliance
Sniffer Appliance
Dedicated DHCP server
Dedicated DNS server
Features
pfSense includes almost all the features in expensive commercial firewalls, and more in many cases. Here is a list of features taken from the pfSense Features page.
Firewall
State Table
NAT
Redundancy
CARP- CARP from OpenBSD allows for hardware failover. Two or more firewalls can be configured as a failover group. If one interface fails on the primary or the primary goes offline entirely, the secondary becomes active. pfSense also includes configuration synchronization capabilities, so you make your configuration changes on the primary and they automatically synchronize to the secondary firewall.
pfsync - pfsync ensures the firewall's state table is replicated to all failover configured firewalls. This means your existing connections will be maintained in the case of failure, which is important to prevent network disruptions.
Outbound and Inbound load balancing
VPN - IPsec, OpenVPN, PPTP
PPPoE Server
RRD Graphs Reporting
Real Time Information - Using AJAX
Dynamic DNS
Captive portal
DHCP Server and Relay
Live CD Version Available
II/INSTALL
Step 1:Install Pfsense from CD
Step 2:enable vlan or no(I choose "no")
Step 3:enter the lan interface name
Step 4:enter the wan interface name
Step 5: enter
Step 6 type "y"
Step 7: setup ip adrress as Diagram III/LOAD BALANCE WEB
Step 8:Set up Load Balancing Pool
The first thing to do is create a pool (Services > Load Balancer > Add).
Step 9:Set up virtual server
Adding a new Virtual Server (Services > Load balancer > Virtual Servers > Add )
Step 10: Set up virtual ip address
Adding a new Virtual IP (Firewall > Virtual IPs > Add )
Step 11:Create Nat(Firewall > Nat > Add)
Note: open port 80 from Internet access to 192.168.0.5 and 192.168.0.6
Step 12:Access to http://192.168.20.204/ and check status load balance
Step 13:Disconnect 192.168.0.5 Access to http://192.168.20.204/ and check status load balance
IV/CLUSTER FAILOVER
As LOAD balance but choose Failover
Besides pfsense can create cluster fail over firewall and load balance outbound
Pen offers fault tolerance by automatically rerouting traffic from servers that are offline. But what if the load balancer goes down? Using VRRP, it is possible to run two load balancers in an active-passive failover configuration
1. uncompress the source 2. cd in the directory 3. type 'make'(Please install gcc* before type make by "yum -y install gcc*") [root@ ~] cp vrrpd /usr/sbin/vrrpd
Install pen and vrrpd on the two load balancer hosts. Start pen on both load balancers and check that both work by surfing to http://102.168.0.1/ and http://102.168.0.2/.
Now start vrrpd like this on both load balancers:
[root@ ~]vrrpd -i eth1 -v 1 192.168.0.3
Now try surfing to http://192.168.0.3/. One of the load balancers will be active and respond at that address
Step 3: config sync for fw (rule,Nat ......)
http://192.168.20.204/ and check status load balance
