Setting up a firewall
Typically, firewalls are set up in 2 types of secure network connections stated below :
- A router/firewall combo is positioned at the gateway to the Internet. The immediate network sits right behind it.
- A router/firewall combo is positioned as the gateway to the Internet, with two separate networks branching out of it. One, into a trusted, internal branch and the other, a non-trusted/DMZ branch.
In general, we recommend deploying Aurea List Manager behind a firewall in a DMZ, so that the machine is separate from the trusted internal network and its access to the internal network is severely restricted. Regardless of your network configuration, it can be configured so that Aurea List Manager can work properly behind your firewall. If some of the terms in this topic are new to you, check the glossary.
Pre-configuration for your firewall
- It is easier to have your mail server and Aurea List Manager on separate machines, with a different IP address assigned to each, because you do not need to make any changes to your mail server. You can also have all incoming mail go to Aurea List Manager first, which can be configured to forward all non-Aurea List Manager mail to another mail server. Some mail servers can be configured to accept all mail, then forward Aurea List Manager’s mail to it. For more information, see Mail Server Coexistence.
- Obtain a set of external IP addresses from your backbone provider or Internet service provider (ISP). You must have at least one. Ideally, you need to have at least one for your mail server and one for Aurea List Manager. Assign one external address to be used for Aurea List Manager.
- Have your ISP make a DNS record for your Aurea List Manager IP address. Most users' DNS servers are managed by their backbone providers or ISP, so it is nothing more than giving your provider the right information regarding the proper resource records that need to be added to your existing domain. You already have a DNS record if you are running a mail server and/or web server.
For example, if you own example.com
, and like to use the IP address 216.11.22.1
for Aurea List Manager. Inform your ISP or backbone provider that 216.11.22.1
should be lists.example.com
or whatever domain like for it to be. Generally, if you own yourdomain.com
, then you create a subdomain like lists.yourdomain.com
or newsletter.yourdomain.com
in order to have a proper domain name for your new Aurea List Manager server.
- We recommend that your ISP also create a reverse DNS record for your domain. Forward DNS ensures that your domain resolves to your IP address. In our example above,
lists.example.com
is going to resolve to216.11.22.1
. Reverse DNSThe ability to resolve an IP address to a domain name. ensures your IP address resolves to your domain name, which is216.11.22.1
resolves tolists.example.com
, for example. Some mail servers refuse to receive mail from hostnames that do not have reverse DNS. - Your MX record states where mail for the domain should arrive. Inform your ISP to set the MX record as to be the same name as your Aurea List Manager domain (For example,
lists.domain.com
). We do not recommend that you forward Aurea List Manager mail from your main mail server to Aurea List Manager, hence why it is important that the domain have its own MX record. - Assign an internal, static IP address for your Aurea List Manager machine. The machine behind the firewall should be assigned a non-routable, private IP address from one of the private address pools in existence. Commonly used addresses are,
192.168.1.1
,10.1.0.1
,192.168.10.1
and so on. Anything that starts with a192.168.
,172.16.0.
and10.0.
is a considered private IP address.
Firewall configuration
Note
The following is not a substitute for your firewall’s documentation; it outlines the general procedures needed to perform. Consult your firewall manufacturer if you have questions about your firewall.
Depending on your firewall, the following methods described below should be used to configure your firewall:
- Assign the Aurea List Manager IP address to your firewall and DNAT
port 25
andport 80
to the machine behind the firewall, which Aurea List Manager is running on. For example, if you have an IP assigned to the firewall as216.11.22.1
, then forward allport 25
andport 80
requests that arrive at that IP address to your internal IP address192.168.1.1
port 25
andport 80
. All requests toport 25
andport 80
on216.11.22.1
automatically get routed to the internal address. All other port requests are dropped or accepted, depending on your default policy rule in the firewall rule set or ACL (Access Control List) - If there is a DMZ network and a separate trusted internal network that houses your workstations, then all that you have to do is simply assign the machine to your DMZ and perform the exact same steps for the firewall at the entrance of your DMZ.
- Start Aurea List Manager. It may complain about not having reverse DNS on its own IP address, but that does not keep it from running properly.
- Go to Utilities > Administration > Sites and edit any sites you have so that the Internet Host Name field for each site is the name of your new Aurea List Manager machine. Also, assign the IP addresses Aurea List Manager should use for SMTP and NNTP on each site. These should be the internal IP addresses assigned to the machine.
- Go to Utilities > Administration > Server > Server Settings > Machine Settings > IP Addresses, and specify what IP addresses ListManager should bind to for DNS lookups. This should be the external IP address assigned to the machine.
Note
Be sure Aurea List Manager has reverse DNS on the external IP address, other wise other mail servers may reject your mail.