[isp-dns] Re: Concerns about high Load

[Spoof <m@...]

> > We have already got Mailscanner working with Sophos, spamassassin and
> > RBL  checking. But thanks for the tip I will have a look.
> But I thought you wanted to migrate all that plumbing overhead from the
> mailbox server to the MX gateway?  That's how to really free up and
> better protect your mailbox server.
yeh this is on the mx gateway taking it away from mailstore.

> I'd go with
>
> 1. edge firewall with only public ip routing and packet filtering, not
> NAT/PAT.
>
> 2. behind which is a  DMZ on a public subnet containing
>
> a. the MX machine with anti-mail abuse stuff, and a c-o DNS.  This DNS
> would also act as resolver for the private network.  the DNS should
> allow-query only for the DMZ and outside ip of the inner firewall.
>
> b. public web server
>
> c. a delegated-only DNS, ie, no recursion.
>
> 3. inner firewall doing PAT/NAT, and packet filtering. the private net
> would contain
>
> a. mailbox server, with port 25 access blocked by the outer firewall, and
> which relays all outbound the MX box in the DMZ.
>
> b. perhaps a caching-only DNS to support the private net, and which
> forwards to the DNS in the DMZ. But the workstations could use the DMZ
> DNS as their nameserver.
>
> The above "DNS forwarding architecture" avoids the complexity of split
> DNS, forward and reverse. And it certainly makes hardening the classic
> double-walled firewalling simpler because the inner and outer filtering
> boxes are running no apps or services beyond the minimum.
What were you saying about wasting money =]

A quick synopsis again:

Mailbox server has: pop3, imap, http, storage.
MX Gateway has: restricted DNS, smtp, av, port forwarding to above services.

The MX/firewall is only a firewall for the one mailstore server nothing
else, no workstations etc... The DNS config has restriced accessibility for
recursion and zone transfers, even to boxes on our network. Effectively it
is a secondary only for delegation as you said and caching for itself and
one server. I see how the above scenario would be good but I think that its
a bit of an overkill in our situation.


I will employ a few things you have said. I havn't just ignored everything
=] Thanks for your help.


Matt