Chapter 04 Networking, DNS & Crypto Admin: #pNetwork

Running Behind pfSense, OPNsense, HAProxy & SSL Gateways

Many enterprise deployments run their web server and SharpMailserver in internal VLANs behind a shared perimeter firewall (pfSense, OPNsense, Sophos) or an SSL/HAProxy gateway. Without Hairpin NAT (NAT Reflection), packets sent from inside the network to your own public WAN IP time out at the gateway.

Operational Tip & Architecture Note

Why did port checks previously report 'Timeout' behind shared gateways? When the probe originated behind the same pfSense firewall without NAT reflection, WAN loopback packets dropped even though external internet clients connected fine. SharpMailserver v1.2.4 detects and compensates for this topology automatically.

pfSense / OPNsense Recommended Split-DNS & Proxy Settings

Split-DNS eliminates WAN hairpin hops for internal users and preserves real LAN source IPs.

Reference / Configuration

# 1. pfSense -> Services -> DNS Resolver -> Host Overrides:
Host: mail    Domain: firma.de    IP: 172.16.0.55 (Interne LAN/DMZ-IP)

# 2. Reverse-Proxy (Nginx / HAProxy) Timeout für ActiveSync Ping (TCP 443):
proxy_read_timeout 960s;
proxy_send_timeout 960s;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`pfSense / OPNsense: Split-DNS (DNS Resolver)`	Resolves mail.company.com directly to the internal LAN/DMZ IP (e.g. 172.16.0.55) for internal clients and sibling servers instead of hairpining via WAN.	`Im Gateway konfigurieren`	Recommended #1 best practice! Add a Host Override in Unbound/DNS Resolver mapping mail.company.com to the internal LAN IP for zero-hop speed and real client IPs.
`pfSense: NAT Reflection (Pure NAT)`	Allows internal hosts to reach port-forwarded WAN services via the public WAN IP when Split-DNS is not used.	`Deaktiviert in pfSense`	If internal hosts must hit the public WAN IP, enable Pure NAT + Automatic Outbound NAT for Reflection under System -> Advanced -> Firewall & NAT.
`SSL-Gateway / Reverse-Proxy für Port 443`	Terminates HTTPS on an edge gateway (HAProxy / Nginx) and forwards Webmail, Admin, CalDAV/CardDAV, and ActiveSync to SharpMailserver.	`Direkt oder Reverse-Proxy`	Increase gateway read/idle timeouts to >= 900s for ActiveSync Ping long-polling and forward X-Forwarded-For + X-Forwarded-Proto headers.
`Smtp/Imap:EnableProxyProtocol (HAProxy v2)`	Extracts the true remote client IP from HAProxy PROXY Protocol v1/v2 headers on TCP ports 25, 465, 587, and 993.	`false (Direktes NAT)`	Keep FALSE for standard pfSense/iptables DNAT port forwards (which already preserve source IPs)! Enable ONLY when HAProxy explicitly sends send-proxy-v2.