main.cf:
smtpd_sasl_exceptions_networks =
# Don't exclude these
!cidr:${config_directory}/allow-sasl.cidr,
# Exclude the rest
0.0.0.0/0
allow-sasl.cidr:
192.0.2.0/24 permit_sasl_authenticated
10.0.0.0/8 permit_sasl_authenticated
172.16.0.0/12 permit_sasl_authenticated
192.168.0.0/16 permit_sasl_authenticated
...
The form of the RHS of allow-sasl.cidr is deliberate, instead
of disallowing authentication, one can allow all addresses to
authenticate, but use allow-sasl.cidr as an access(5) table
to allow relaying from only certain SASL clients:
# Postfix 2.10 or later, ocnsider: smtpd_relay_restrictions
smtpd_recipient_restrictions =
permit_mynetworks,
check_client_access cidr:${config_directory}/allow-sasl.cidr,
reject_unauth_destination,
... UCE restrictions ...
Rules for detection client are evaluated in the following order:
1. smtpd_client_restrictions
2. smtpd_helo_restrictions
3. smtpd_sender_restrictions
4. smtpd_recipient_restrictions
I think it would be better to move the parameter:
'check_client_access cidr:${config_directory}/allow-sasl.cidr'
to the section 'smtpd_sender_restrictions'. Must also be in the
'smtpd_recipient_restrictions'?
