Setting up a multi-homed Kerio Mailserver in a DMZ


2012/08/12

A customer had to do an emergency transplant of his mail server because of a failing system. That's not at all hard to do with Kerio Connect (see How do I move Kerio Connect from one machine to another (or change Operating Systems)?), but when he finished up, the new server was not able to receive mail.

The configuration had one NIC plugged into the local LAN and the other with a public IP address in the DMZ. A Kerio Control firewall protects the internal network.

My assumption was that he had accidentally enabled a firewall on the new system or that the public side NIC was bad, but I was wrong - the customer himself found the problem after thoroughly reviewing his configuration.

Routing

The actual problem was routing - when packets came IN to the public IP side, the system was trying to respond to them through the router on the internal NIC. From the Kerio Control firewall's point of view, here were responses to packets it had never seen coming in - quite naturally it wasn't going to let those through. The Ubuntu graphical network configuration tool has a simple check box that needed to be enabled on the LAN card. It says "Use this connection only for resources on its network". With that checked, response packets for the public IP would go out the same interface where they had come in, and the mail server could now receive mail.

The other way to configure this is to ONLY use the one local IP address and have the firewall forward appropriate ports inward. That's the way most systems are set up today; but you need to keep routing in mind when configuring multi-homed servers.

I don't know why I messed that. It had been a long day (I exhausted my cell phone battery twice that day and did the same thing to one of my wireless home phones!) and I was tired, but as we had tried switching cards (putting the public IP on the lan side and vice-versa), cables and switch ports, and the customer could not identify any local firewall, it HAD to be routing and I just didn't pursue it. Oh well: another day, another lesson learned.

Ubuntu Multihomed Setup

Network Connections

IPV4 Settings

Routes

Use this connection only for resources on its network



Got something to add? Send me email.





(OLDER) <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> -> Setting up a multi-homed Kerio Mailserver in a DMZ




Increase ad revenue 50-250% with Ezoic


More Articles by

Find me on Google+

© Anthony Lawrence



Kerio Connect Mailserver

Kerio Samepage

Kerio Control Firewall

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us





Random numbers should not be generated with a method chosen at random (Donald Knuth)

Zawinski's Law: Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can. (Jamie Zawinski)







This post tagged: