Showing posts with label ispconfig. Show all posts
Showing posts with label ispconfig. Show all posts

Monday, July 15, 2013

Postfix behind Iptables masquerade (NAT)


I've been working on a mail server behind iptables masquerade for some days, and it just didn't work, but I found the solution, it may help you.

If you use SMTP server behind NAT, and you get the following errors:
  • mail postfix/smtp[7854]: warning: host gmail-smtp-in.l.google.com[173.194.70.26]:25 greeted me with my own hostname mail.example.com
  • mail for gmail.com loops back to myself
you should check your iptables configuration. A proper port-forward config:



iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d PUBLICIP --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to MAILSERVERPRIVATEIP:25

(Only forward packets from port 25 to your mail server's private IP port 25, if it comes from the outside.)

You can test it on your mail server by telnetting to a foreign smtp server for example:

telnet smtp.gmail.com 25

It should show:

Trying 173.194.70.108...
Connected to gmail-smtp-msa.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP r54sm45040303eev.8 - gsmtp

If you see


220- mail.yourdomain.com gsmtp

you config is not good yet.

Saturday, December 1, 2012

ISPConfig + NginX + PHP-FPM + multiple PHP versions

This article is about setting up multiple PHP versions with PHP-FPM with nginx. Basically, its a note for myself, but maybe you can also use it. When this article was written, the stable PHP version was 5.4.9, so I will use that here.

It's a testing configuration, there might be security bugs, so don't use it in production!

This article is based on Ondřej Šimek's article.

So first of all, we need the actual PHP stable version, download it, unzip it, and copy it to /usr/local/src. After PHP 5.4.0, you don't need to patch. (if you need previous version, use Ondřej Šimek's tutorial for patching)

wget http://www.php.net/get/php-5.4.9.tar.gz/from/a/mirror
tar xjf php-5.4.9.tar.gz

mkdir /usr/local/src/php
mkdir /usr/local/src/php/5.4.9
mv php-5.4.9 /usr/local/src/5.4.9

Next, we need to run ./configure, and compile it. I like to install php separately to /opt/php/5.4.9

mkdir /opt/php
mkdir /opt/php/5.4.9

So run ./configure with the choosen options. You need at least these:
--prefix=/opt/php/5.4.9
--enable-fpm
(--enable-fastcgi)
--without-pear

./configure --prefix=/opt/php/5.4.9 --enable-fpm --without-pear

You may or may not need to use --enable-fastcgi, it depends on the php-version, as I can remember, since 5.3.0 you don't need to use, because it's a must-have option.

After running configure, run:

make & make install

It will create some files in /opt/php/5.4.9. You may need to copy the recommended php.ini from the source folder:

cp /usr/local/src/php-ini-production /opt/php/5.4.9

Now, you need to change some configurations in the inis:

nano /opt/php/5.4.9/etc/php-fpm

ISPConfig uses listen port 9000, so you need to change it, to for example: 9001. You may want to set up logging, you can find several lines and settings about logging, its not hard to find.

Now, you can start php-fpm:

./opt/php/5.4.9/sbin/php-fpm

Next, go to your admin panel (ISPConfig), go to System, and additional PHP versions (only available in ISPConfig 3.0.5!). Create a new php version:

FastCGI settings:
Binary: /opt/php/5.4.9/bin
PHP.ini directory: /opt/php/5.4.9

PHP-FPM settings:
init-script: /opt/php/5.4.9/etc
PHP.ini directory: /opt/php/5.4.9/
POOL directory: /opt/php/5.4.9

Save it, then go to websites, and change PHP-version where you need. It will throw a ,,Bad Gateway" error,  because you didn't edit the nginx settings:

cd /etc/nginx/sites-available
nano yoursite.vhost

Then change the listen port to the port you defined earlier.

fastcgi_pass 127.0.0.1:9001

At the and: reload nginx and hurray.

/etc/init.d/nginx reload

HURRAY

Now, I have to figure out how to automatise the port change in the .vhost files..