Forum Discussion

dp_119903's avatar
dp_119903
Icon for Cirrostratus rankCirrostratus
Jul 21, 2016

SMTP VIP - Pass Client IP Address

I've seen quite a few posts on here regarding SMTP and passing the client IP address to the server. I am bringing it back up b/c most of the threads I read were fairly old and/or incomplete and I wanted to make sure I understood the options/benefits, etc.

 

I have a virtual that points to SMTP servers. The issue is we are using SNAT so the SMTP servers are seeing the IP address of the F5 which impacts their ability to whitelist/blacklist things. Ultimately they want to see the IP address of the client.

 

As I understand it I have 3 options.

 

  1. Disable SNAT and make the F5 the default gateway for the SMTP servers
  2. Setup a forwarding virtual server as the SMTP VIP (I suspect that this would limit our ability to do things with APM or ASM if we were to chose too at a later date)
  3. Somehow insert the client IP address into the TCP header (similar to what x-forwarded-for does for http requests).

The third option seems like the best one for me, however I haven't yet seen exactly how to do that. Does it require an irule and if so is it really best practice to subject ALL of the inbound SMTP traffic to be inspected by an irule?

 

Is there some method I've left off? If someone does know how to elaborate on the 3rd option, is it an irule, and if so what sort of irule are we talking about? What header field would I insert the client IP address in? I read something about the "comments" field, but I don't know what that is in reference to b/c I didn't know the TCP header had a comments field (I'll do a little deeper digging once I'm done with this question).

 

Thanks in advance!

 

application delivery
devops
iRules
LTM

1 Reply

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jul 21, 2016

    this has come up a few time recently and i think 3 is pretty difficult. the TCP header has no real space for this, you could look at this example but that will require you email server to understand this trick and i doubt any do that.

     

    https://devcentral.f5.com/articles/accessing-tcp-options-from-irules

     

    the other possibility is an application header (the HTTP headers you mentioned are not TCP headers they are application headers) but that is also not that straight forward. someone suggest the X-Originating-IP header and this might be possible but the SMTP protocol isn't that nicely accessible as the HTTP protocol so you will have to collect the email, make changes and pass it on. while not totally impossible it isn't easy and might break things.

     

    as long as there isn't a clearly defined field as with HTTP this won't be something done easily.