I’d like stunnel to pass the incoming IP along, not stunnel's IP.

My traffic flow is:

Stunnel (accept on port 465) -> ASSP (an smtp proxy) -> Postfix (accept on port 10026)

I tried:

[ssmtp]

client = no

accept = 465

connect = 25

protocol = proxy

But ASSP had:

Apr-15-19 18:50:22 [Worker_1] Connected: session:7FE104AA1870 127.0.0.1:58954 > 127.0.0.1:25 > 127.0.0.1:10026

Apr-15-19 18:50:23 [Worker_1] 127.0.0.1 warning: got reply '502 5.5.2 Error: command not recognized' from 127.0.0.1

Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 info: sending EHLO instead of HELO to 127.0.0.1

Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 disconnected: session:7FE104AA1870 127.0.0.1 - processing time 1 seconds

And Postfix had:

2019-04-15 18:50:22.995042+1000 localhost smtpd[33360]: connect from localhost[127.0.0.1]

2019-04-15 18:50:23.108756+1000 localhost smtpd[33360]: improper command pipelining after EHLO from localhost[127.0.0.1]: RSET\r\n

2019-04-15 18:50:23.273664+1000 localhost smtpd[33360]: disconnect from localhost[127.0.0.1] ehlo=2 rset=1 quit=1 unknown=0/1 commands=4/5

So I take it protocol=proxy is not the way to do it. Sounds like this only works with haproxy which I do not have installed.

Is there a way to do this?

The problem I am trying to solve is ASSP has lines like:

warning: SMTP authentication failed on 127.0.0.1

- obviously I don’t want fail2ban to ban 127.0.0.1.

Stunnel log has:

2019.04.15 18:52:26 LOG5[23]: Service [ssmtp] accepted connection from ::ffff:185.222.209.66:53642

2019.04.15 18:52:27 LOG3[23]: s_connect: connect ::1:25: Connection refused (61)

Any suggestions?

Thanks,

James.