The most elegant solution to the “mismatched MX records” problem would be to force the firewall to send out traffic on the appropriate Internet IP address for all servers. If traffic came from the NATed internal IP address of 192.168.10.4 then the firewall would send this traffic out on 61.56.223.4 (web.myserver.com) rather than the firewall’s IP address (61.56.223.2). This can be set up using IPtables, but must be edited in the rc.firewall file rather than rc.firewall.local.
Navigate to the same directory we were in before (/etc/rc.d) and type “nano rc.firewall” and press enter.
You need to look at the bottom of the “iptables_red()” section and insert some code right before the #outgoing masquerading line.
# all outgoing traffic should appear to come from the original server's IP
/sbin/iptables -t nat -A RED -s 192.168.10.3 -o $IFACE -j SNAT --to-source 61.56..223.3
/sbin/iptables -t nat -A RED -s 192.168.10.4 -o $IFACE -j SNAT --to-source 61.56.223.4
/sbin/iptables -t nat -A RED -s 192.168.10.5 -o $IFACE -j SNAT --to-source 61.56.223.5
# Outgoing masquerading
/sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
Of course, change the internal IP (192.168.10.x) to your server’s IP and the external (61.56.223.x) to your server’s external internet IP. The goal of this code is to translate any port coming from any of these internal IPs on my DMZ to the same port on their corresponding Internet address. This would be the preferred method over updating your MX records to match your firewall, as it would remove all restrictions and still allow for MX lookups to not tag my mail as spam.
Once this is implemented, exit PuTTY, turn off SSH, and reboot your server. You should see all traffic coming from your internal servers being sent out on their registered internet addresses.
Ok, now your email clients are broken. The next page shows you how to fix them…
