# ClamSMTP: Transparent Proxying

A transparent proxy is when you grab a certain type of traffic at your gateway or router and send it through a proxy without the knowledge of the user or client. Here's a simple description of how to use ClamSMTP as a transparent proxy to do virus checking on SMTP traffic going in or out of your network.

You should already be familiar with routing and network administration. Those topics are not touched on here.

Note that certain features of SMTP are disabled when going through `clamsmtpd`, most notably SSL/TLS. Authentication does however work. Transparent proxying has only been tested in recent versions of FreeBSD (using ipfw) and Linux (using iptables).

This setup assumes the `clamsmtpd` proxy is running on the same machine as the gateway. Running it on a different machine is possible, but more complicated to setup.

## ClamSMTP Setup

- Make sure you're using ClamSMTP version 0.8 or later.
- Enable the `TransparentProxy` option in the config file. The `OutAddress` should be removed as the out address will be determined by the original destination of the SMTP connection.
- Be sure you have enough connections to support all the anticipated SMTP traffic. Use the `MaxConnections` option to adjust this.
- The examples below assume `clamsmtpd` is listening on the default port of `10025`.
- Make sure `clamd` (the ClamAV daemon) is running, and its listening on the socket you specified. You can set this in `clamav.conf` using the `LocalSocket` or `TCPSocket` directives (only uncomment one). Also make sure the `ScanMail` directive is on.
- As usual, make sure to start `clamsmtpd` as the same user you run `clamd`, usually it's called `clamav`.

## FreeBSD

Your kernel needs support for ipfw. You can either load this as a kernel module by executing the following:

    # kldload ipfw.ko

Or you can build it into your kernel by adding the following lines to your kernel config file. See the FreeBSD Handbook for info on how to build a kernel. Make sure to install and reboot with the new kernel before proceeding.

    IPFIREWALL
    IPFIREWALL_FORWARD

Make sure IP forwarding (routing) is turned on. It probably already is as transparent proxying happens on a router.

Run the following command. It adds a line to your firewall to route traffic to `clamsmtpd`.

    # ipfw add 100 fwd 127.0.0.1,10025 tcp from not me to any 25

## Linux

If your kernel does not contain transparent proxy support you need to recompile your kernel with the following options. Recompling your linux kernel is beyond the scope of this document. You can find many tutorials on the subject online. After rebuilding and installing your new kernel make sure to reboot.

    * Under General Setup
        o Networking support
        o Sysctl support
    * Under Networking Options
        o Network packet filtering
        o TCP/IP networking
        o Fast switching: *NO*
    * Under Networking Options -> IP: Netfilter Configuration
        o Connection tracking
        o IP tables support
        o Full NAT
        o REDIRECT target support
    * Under File Systems
        o /proc filesystem support

Make sure IP forwarding (routing) is turned on. It probably already is as transparent proxying happens on a router.

Run the following command and add it to your boot scripts. Make sure to substitute your NIC name in the command below:

    # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25 -j REDIRECT --to-port 10025

###### Copyright 2002, N. Nielsen [ clamsmtp | home page ]