postfix smtp_bind_address directive not working

Question

I recently migrated to a new server (running postfix 3.3.0) and noticed that the smtp_bind_address setting in master.cf is having no effect. The server in question has 10 ipv4 addresses and it's important that outgoing mail is routed through the correct one. Here is a snippet of what I have (192.168.100.1 is only an example — the actual ip is a real wan address):

smtp      inet  n       -       y       -       -       smtpd
  -o smtp_bind_address=192.168.100.1
smtps     inet  n       -       y       -       -       smtpd
  -o smtp_bind_address=192.168.100.1

I also have amavis and postsrsd running alongside this mailserver so the mail is being handed off from one service to the next and to be honest I'm a bit confused about the chain of events, but previously this configuration was working perfectly.

I tried moving smtp_bind_address to main.cf and it did work, but other problems arose since amavis and postsrsd both expect mail to be handed off via 127.0.0.1.

How can I bind outgoing mail to a specific address in conjunction with my content filters?

Answer 1

Outgoing smtp/relay connections are controlled by these lines in master.conf

smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp

So, you could add -o smtp_bind_address=192.168.100.1 to the one you need.

Also, you could use this combination in main.conf

inet_interfaces = 127.0.0.1 192.168.100.1
smtp_bind_address = 192.168.100.1

This allows applications to connect to 127.0.0.1, while binds outgoing smtp to the particular address by default.

Don't forget that firewall may override all these configurations, e.g. this simple rule:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

will translate any outgoing connection's source address (from interface eth0) to the primary (default) address of this interface. From the other point of view, you could set smtp connections source address with firewall (without configuring postfix):

iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 25 -j SNAT --to-source 192.168.100.1

But this is not flexible, and I would only do this as last resort (e.g. you don't have permission to modify postfix settings).