Hacker News Reader

Comment by ivansavz | Hacker News Reader

Does anyone have experience running a mail server on a home connection with a dynamic IP?

I'm imagining a system that will have a homebox (long term storage, privacy) and a cloudbox (provides availability) and the mail flow will be like this:

   sender ---(1)---> cloudbox  ---(2)--->  homebox

Assuming cloud stays up (1) will happen, and if homebox is reachable, then (2) will also happen. However, if (2) can't be done, then cloudbox will temporarily hold the email until homebox comes online (POP mail style).

Has anyone ever setup something like this before? Any pointers will be appreciated.

View on HN

This is pretty well trodden ground, between people here and google of decades of history you'll have no problem. Don't forget to implement the arrows flipped around, I sent all my outgoing thru my cloud server after authentication, so everything goes in and out the same way. Eventually I gave up because in my situation forward everything to gmail is not an issue for me; email is just a spam and amazon receipt delivery service, so its not worth much effort.

Anyway one interesting design aspect is you're going to fetchmail from home to a cloud pop server and you'll want to secure that, so the natural inclination is to take smallest possible steps while testing all the way, first you try an unusual port number to keep scanners away, maybe you only allow the big netblocks from your provider (not specific /32 addrs but if your provider gives you an addrs from a /19 well then permit the whole /19) then all manner of SSL/TLS protocols instead of plain text passwords and things like that.

But I'd advise saving a lot of time and going big for security before even playing with the mail system. So put openVPN on the cloud provider and have your home and your phones/tablets/laptops/friends/family can VPN into your big happy psuedo-internal LAN... don't let "the internet" connect to your cloud pop (imap?) server at all, only allow connections from internal (via VPN) addresses. You're probably going to end up doing it sooner or later and a VPN'd config obsoletes quite a bit of internet accessible stuff for the pop server. You can have a perfectly static internal LAN addrs for homebox and cloudbox over the VPN, even if endpoint addrs change, which makes some simple ip address firewall rules easier than if both endpoints were dynamic. So by the magic of openvpn 10.1.0.0/16 is in the cloudbox and 10.2.0.0/16 is at home, all the time forever, regardless of current provider both at home or cloud, which makes it pretty easy to create static iptables rules and such.

I find it handy to have my phone and tablet always on my home network, because I have fun stuff on my home network. So I'm going to be doing this anyway... may as well use the same security infrastructure to secure my fetchmail sessions rather than trying to secure them on the open internet.

I've not tried the above -- but there shouldn't be any problem with it (although if you control both servers, you might as well not use smtp from 1 to 2). If you want to do this, you could also just try and keep your dns ttl reasonably low, and updated, and recieve stmp straight at home -- after all:

"The sender MUST delay retrying a particular destination after one attempt has failed. In general, the retry interval SHOULD be at least 30 minutes; however, more sophisticated and variable strategies will be beneficial when the SMTP client can determine the reason for non-delivery.

Retries continue until the message is transmitted or the sender gives up; the give-up time generally needs to be at least 4-5 days." (My emphasis) http://www.ietf.org/rfc/rfc2821.txt

I host quite a few things out of my home connection, not a mail server (yet) because I know my specific IP blocks inbound port 143 and I didn't want to get into a fight with them over running imap off another port.

But I just use a dynamic dns address from freedns. I leave my computer on 24/7, and I just run all my web services as nobody users and use fail2ban and ufw as access control., and I prefer secret key authentication over password based auth methods when I can (nothing stops me from giving someone my certs if I want them using some service I provide).

Certainly. There are several ways to set it up. For example, you can set cloudbox as your domain's MX with a lower priority than homebox. If mail can't get to homebox, the originating mail server will try cloudbox automatically. If cloudbox's MTA is running in secondary mode, it will try to deliver to homebox, but hold it in the queue until it succeeds.

Or, you could have all mail sent to cloudbox, and use imapsync or getmail or fetchmail to pull mail off of it whenever you want.

Or you can use UUCP-over-ssh.

> you can set cloudbox as your domain's MX with a lower priority than homebox.

This is one way to do this, but if you do, remember that a spamming tactic in the past has been to direct spam to the lower priority MX records as often they were somewhat forgotten and not kept up with the latest spam guards.

Basically, always make sure your primary and secondary mail servers have the same and latest of whatever you are using to stomp on spam.

You will also want to change the length of time things are held in the queue. The default is something like 7 days. That might not be long enough if you're using the secondary MX as a failsafe.

I'm not familiar with cloudbox, but depending on your ISP be prepared to handle issues with spam filtering and the possibility that port 25 may be blocked

Reply on news.ycombinator.com