I have a HAProxy box with centos7 and doing load balance proxy for a smtp cluster providing mail relay to our customers.
default gateway => 10.0.0.1 master-relay.example.net => 10.0.0.254 relay1.example.net => 10.0.0.10 | gateway 10.0.0.1 relay2.example.net => 10.0.0.11 | gateway 10.0.0.1 relay3.example.net => 10.0.0.12 | gateway 10.0.0.1
Each relay have postfix configured to listen on port 25 and 587.
What I need to achieve is when anyone tries to send a mail connecting directly to one of the 3 relays (relay1, relay2 or relay3) forward the answer packets to the default gateway. This is usually when any external mail server tries to send us an email and connects randomly to one of the 3 MX servers with the same priority.
BUT, when an mobile or webmail client connects to the cluster to relay an email it does to master-relay and this one connects to one of the 3 MX servers to deliver the mail.
This is the HAProxy's configuration for the cluster:
# Puerto 25 - SMTP (Postfix Cluster) frontend frontend-smtp-25 bind 10.0.0.254:25 transparent option tcplog default_backend backend-smtp-25 backend backend-smtp-25 option tcplog source 0.0.0.0 usesrc clientip server mx1 10.0.0.10:25 check server mx2 10.0.0.11:25 check server mx3 10.0.0.12:25 check # Puerto 587 - STARTTLS (Postfix Cluster) frontend frontend-smtp-587 bind 10.0.0.254:587 transparent option tcplog default_backend backend-smtp-587 backend backend-smtp-587 option tcplog source 0.0.0.0 usesrc clientip server mx1 10.0.0.10:587 check server mx2 10.0.0.11:587 check server mx3 10.0.0.12:587 check
net.ipv4.tcp_tw_reuse net.ipv4.tcp_tw_recycle net.ipv4.ip_local_port_range = 1025 65535 net.ipv4.ip_nonlocal_bind = 1 net.ipv4.ip_forward = 1
iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100
Now with this configuration if I change the default gateway of my relay boxes to the master-relay ones all goes fine and in postfix log I can see the client's IP address and not the master-relay's one, but here I have a problem, if anyone connects directly to the relay1 for example this one answers throught master-relay and not throught the gateway and the client discards the packet because don't come from the relay1 box.
What I was trying o do is to mark the source mac-address of the master-relay on all the 3 relay boxes and all that match the marks change the default gateway to the master-relay's one.
All the IP's are public IP's and all are visible from internet.
What I can do is put 2 IP's in the same interface and if any packet comes to IP1 then reply to one gateway and if it comes to IP2 reply to the other gateway but I really preffer the mac rules if it is possible.
I can't do a rule to force that if packets come from master-relay ip address reply to it again because it will come to the proxy with the client ip address.
Thanks in advance