Contributed by tbert on from the divert-power-to-shields dept.
hange spamd to use divert-to instead of rdr-to. divert-to has many advantages over rdr-to for proxies. For example, it is much easier to use, requires less code, does not depend on /dev/pf, works in-band without the asynchronous lookup (DIOCNATLOOK ioctl), saves us from additional port allocations by the rdr/NAT code, and even avoids potential collisions and race conditions that could theoretically happen with the lookup. Heads up: users will have to update their spamd PF rules from rdr-to to divert-to. spamd now also listens to 127.0.0.1 instead of "any" (0.0.0.0) by default which should be fine with most setups but has to be considered for some special configurations.
Those of you running spamd setups looking to upgrade need to double-check your pf configurations to make sure they still work the way you expect.
(Comments are closed)