我在集群中有三个中继服务器，位于 ELB 后面。网络上的内部服务器连接到 ELB 并发送其 SMTP 流量。然后，流量被路由到中继服务器，然后被发送到目标中继服务器。我已经能够通过 TelNet 确认此功能，但是当我将 postfix 配置更改为指向 main.cf 中的 ELB 时，我无法连接到中继服务器。我不确定问题是什么：以下是我在 main.cf 中的配置：
# RR: Mon Apr 29, 2013 => added 72.172.71.2/32 to support (LA) Duo VPN
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
myhostname = test.com
mydomain = test.com
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost
smtpd_delay_reject = yes
smtpd_helo_required = yes
soft_bounce = no
strict_rfc821_envelopes = yes
local_header_rewrite_clients = permit_mynetworks
smtp_generic_maps = pcre:/etc/postfix/generic
unknown_local_recipient_reject_code = 550
broken_sasl_auth_clients = no
smtpd_sasl_application_name = smtpd
smtpd_sasl_auth_enable = no
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
#tls_random_source = dev:/dev/urandom
#smtpd_tls_security_level = may
mailbox_size_limit = 102400000
message_size_limit = 51200000
queue_minfree = 76800000
smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unknown_client
smtpd_helo_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_hostname,
reject_non_fqdn_hostname
smtpd_sender_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unlisted_sender,
reject_non_fqdn_sender,
reject_unknown_sender_domain
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unlisted_recipient,
reject_non_fqdn_recipient,
reject_unauth_destination,
reject_unknown_recipient_domain
# check_recipient_access hash:/etc/postfix/filtered_domains
smtpd_data_restrictions =
permit_mynetworks,
reject_unauth_pipelining,
permit_sasl_authenticated
smtpd_end_of_data_restrictions =
unknown_local_recipient_reject_code = 550
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
#inet_protocols = all
postscreen_upstream_proxy_protocol = haproxy
master.cf：
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
submission inet n - n - - smtpd
# -o smtpd_enforce_tls=yes
-o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps inet n - n - - smtpd
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#628 inet n - n - - qmqpd
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - n - - smtp
-o fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - n - - showq
error unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# The Cyrus deliver program has changed incompatibly, multiple times.
#
old-cyrus unix - n n - - pipe
flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
cyrus unix - n n - - pipe
user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
这是我在中继服务器邮件日志中看到的内容：
AED0D6093E: message-id=<20170420163035.AED0D6093E<test.com>
邮件客户端显示无法送达。如果有人知道发生了什么，请告诉我。
答案1
我能够让 Postfix 看到 NLB 后面的客户端 IP 地址，方法是选中目标群体属性。无需使用 HAproxy 或激活代理协议 v2。
答案2
如果您想在 ELB 后面使用 postfix，则必须使用 postscreen 和 haproxy 才能使其工作。将以下行添加到配置：main.cf：
postscreen_upstream_proxy_protocol = haproxy
master.cf：
smtp inet n — — — 1 postscreen
smtpd pass — — — — — smtpd
您还需要更改 fELB 的配置，以下是为 postfix 设置 ELB 的链接：https://medium.com/@signalnine/preserving-source-ip-running-postfix-behind-amazon-elastic-load-balancer-2a241b69681a