On -10.01.-28163 20:59, Rick Thomas wrote:

But a laptop that’s sometimes inside, sometimes outside doesn’t have a fixed port to connect to. For those cases, I’d like the dovecot server to recognize the outside ports on the inside.

Well, if offering the *exact same* functionality on a second port is all that needs to be done, having the server's host firewall (iptables?) duplicate the NAT on your border firewall for internal accesses should do just fine; no need to majick it into the dovecot config (which opens the possibility of functional differences being introduced unintentionally).

Assuming Red Hat or similar with no conflicting iptables rules (yet),

iptables -t nat -A PREROUTING -p tcp --dport 30xxx -j DNAT --to :143

iptables -t nat -A PREROUTING -p tcp --dport 30yyy -j DNAT --to :993

service iptables save

Regards, J. Bern

*NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>: Server--Storage--Virtualisierung--Management SW--Passion for Performance Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

Thanks! Gedalya and Jochen!

I hadn’t realized I could do that with iptables. I’ll read-up on the documentation.

Rick

On Aug 25, 2014, at 5:38 AM, Gedalya <gedalya@gedalya.net> wrote:

On 08/25/2014 08:26 AM, Jochen Bern wrote:

...

Well, if offering the*exact same* functionality on a second port is all that needs to be done, having the server's host firewall (iptables?) duplicate the NAT on your border firewall for internal accesses should do just fine; no need to majick it into the dovecot config (which opens the possibility of functional differences being introduced unintentionally).

Assuming Red Hat or similar with no conflicting iptables rules (yet),

iptables -t nat -A PREROUTING -p tcp --dport 30xxx -j DNAT --to :143

iptables -t nat -A PREROUTING -p tcp --dport 30yyy -j DNAT --to :993

service iptables save

Regards, Since you're redirecting to a port on the same host, the following is perhaps more correct:

iptables -t nat -A PREROUTING -p tcp --dport 30143 -j REDIRECT --to-port 143

On 08/25/2014 05:17 PM, Jochen Bern wrote:

On -10.01.-28163 20:59, Gedalya wrote:

...

On 08/25/2014 08:26 AM, Jochen Bern wrote:

...

Assuming Red Hat or similar with no conflicting iptables rules (yet),

iptables -t nat -A PREROUTING -p tcp --dport 30xxx -j DNAT --to :143

Since you're redirecting to a port on the same host, the following is perhaps more correct: iptables -t nat -A PREROUTING -p tcp --dport 30143 -j REDIRECT --to-port 143 The operational word being "perhaps". My approach will break if the server does any forwarding, yours will break if dovecot listens only on a secondary IP address, or at least that's what the manpage I grabbed off a CentOS 6 says: That REDIRECT rule can definitely not be used in that exact form if the machine does forwarding. It will make anyone trying to reach port xxxxx on any destination arrive at this IMAP server, unless you add a condition such as -d 192.168.x.x Indeed, if the machine is also a router and dovecot only listens on a specific IP address then you would have to use DNAT to specify the destination IP address and port. Perhaps the use of the word "correct" was wrong, REDIRECT is just typically used in such cases where the machine is anyway not a router so it's kind of a more readable way to say "redirect this traffic from this machine itself to this machine itself", although REDIRECT is generally intended to be used on a router to force traffic _not_ destined for this machine to go to this machine, e.g. setting up a transparent proxy.

So you can say: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.11 --dport 30143 -j REDIRECT --to-port 143 Or: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.11 --dport 30143 -j DNAT --to-destination xx.xx.xx.xx:143

The latter redirects traffic destined to a specific IP address and port, 192.168.1.11:30143, to a specific IP address and port (presumably on the same host, or not..).

...

REDIRECT [...] It redirects the packet to the machine itself by changing the ^^^^^^^^^^^^ destination IP to the primary address of the incoming interface ^^^^^^^^^^^^^^^^^^^^^^#######^^^^^^^^ (locally-generated packets are mapped to the 127.0.0.1 address). Regards, J. Bern

OK, project for today: Give this a try…

Rick

On Aug 25, 2014, at 5:34 AM, Gedalya <gedalya@gedalya.net> wrote:

On 08/24/2014 05:26 PM, Rick Thomas wrote:

...

Can I have multiple “service” clauses for the same service? Each with a different port? Or multiple “inet_listener imap”/“inet_listener imaps” clauses? Or should I have something like this? port = 143,30143

This works:

service imap-login { inet_listener imap { port = 143 } inet_listener imap2 { port = 144 } #inet_listener imaps {

port = 993

ssl = yes

#} }