Hello,
I’m running on a VPS that blocks outgoing email (outgoing TCP connections to port 25 (unless the receiving side uses IPv6, which my VPS neglected to block)).
What are my options to bypass the restriction?
- Set up WireGuard VPN to my home router, and teach the Postfix in Simple NixOS Mailserver to route traffic via it
- Set up Postfix on home router - unfortunately, there’s not enough storage space, and if I extend my OpenWRT onto a USB stick, it’ll start overheating and losing WiFi
- Set up a Raspberry or and old Android phone or something to run Postfix - That’s an option, but it would mean yet another wall wart, and yet another potential mode of failure
- … are there any other options I’m not considering?
I noticed that Postfix has an option called smtp_bind_address that lets one choose the source address of outgoing SMTP connections. I suspect that if I set WireGuard’s address (the one attached to wg0 interface) there, Linux will route it over WireGuard’s interface[1], or there could be some non-default way to ask it to route it like this.
Could I get some help with setting up option 1: I need to add a new option to SNM. I forked Simple NixOS Mailserver and added this commit to set the option, then switched my NixOS conf to this fork:
$ git show -U0
...
@@ -11,4 +11,3 @@ in {
- (builtins.fetchTarball {
- url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz";
- # This hash needs to be updated
- sha256 = "1ngil2shzkf61qxiqw11awyl81cr7ks2kv3r3k243zz7v2xakm5c";
+ (builtins.fetchGit {
+ url = "https://gitlab.com/cizra/nixos-mailserver.git";
+ ref = "master";
@@ -226,0 +226 @@ in {
+ smtpBindAddress = "10.100.0.2"; # route outgoing mail through VPN, to bypass Azure's block on outgoing SMTP port 25
This gave me some error about lastModified. I grepped the SNM repo for this word, and deleted the flake configuration that mentioned it. That didn’t help. I verified, the flake bits are now gone from /nix/store/clone-of-my-repo, yet I still get this error:
# nixos-rebuild switch
error: The option `lastModified' does not exist. Definition values:
- In `/home/elmo/.config/nixos/server.nix': 1688422006
(use '--show-trace' to show detailed location information)
# nixos-rebuild switch --show-trace
error:
… while evaluating the attribute 'config'
at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:326:9:
325| options = checked options;
326| config = checked (removeAttrs config [ "_module" ]);
| ^
327| _module = checked (config._module);
error: The option `lastModified' does not exist. Definition values:
- In `/home/elmo/.config/nixos/server.nix': 1688422006
building Nix...
error:
… while evaluating the attribute 'config'
at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:326:9:
325| options = checked options;
326| config = checked (removeAttrs config [ "_module" ]);
| ^
327| _module = checked (config._module);
error: The option `lastModified' does not exist. Definition values:
- In `/home/elmo/.config/nixos/server.nix': 1688422006
building the system configuration...
error:
… while evaluating the attribute 'config.system.build.toplevel'
at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:326:9:
325| options = checked options;
326| config = checked (removeAttrs config [ "_module" ]);
| ^
327| _module = checked (config._module);
error: The option `lastModified' does not exist. Definition values:
- In `/home/elmo/.config/nixos/server.nix': 1688422006
No files in my NixOS conf mention the word lastModified, and the only change is the switch to my own fork of SNM repo. What am I doing wrong that I’m getting this error?
Also, would this approach of setting the bind address help my case at all?
I hear iptables (and these days nft) can be used to set different firewall rules per user, and Postfix runs as its own user. Should I investigate instead how to accomplish this routing using the firewall, instead?
[1] - though I’ll have to figure out what to set the allowedIps value - if I set it to an empty list, WireGuard will refuse to route anything. If I set i to 0.0.0.0/0, it’ll set wg as a default route for everything, which I don’t want. As a horrible hack, I might create a systemd service that deletes the new default route, and set it to run after WireGuard comes up. Or something.
