NethServer as antispam antivirus gateway to your mail server

#An amazing and easy solution to filter your email: NethServer


An organization with an internal mail server (eg. Microsoft Exchange server) with no antispam/antivirus email filter or with a commercial solution that organization wants to replace.

##Brief introduction

Filter emails is a common problem of small/medium business, why not try a new amazing solution based on linux, with a straightforward installation and a clear administration Web interface? Newer to linux? Don’t be scared!
With this article you will be able to install, configure and manage your NethServer as well as any other solution available on the market such as SOHO hardware firewall, software or service.

##Solutions comparison

The Table below reports pros and cons of commons solutions we can find in small/medium low budget business.

##What you need to know about NethServer
NethServer offer:

Prepare migration to NethServer is a short to do list:

##Build your antivirus/antispam gateway with NethServer
Remember table at top of this post? Which solution are you actually using?
Basically you could be in one of these two network situations:

  • Situation A: your Internet gateway (eg. router ADSL) and your Exchange server are both attached to your LAN hub/swicth
  • Situation B: you Internet gateway (eg. router ADSL) is attached to the WAN interface of your firewall, LAN interface of your firewall and your Exchange server are both attached to your LAN hub/switch

If you are in the situation “A” you have to change network subnet class addresses of your Internet gateway, for example: from to
then you have to configure your NethServer first NIC with IP address to communicate on LAN and the second NIC could be configured with IPaddress to communicate with your Internet gateway.
NethServer’s second NIC must be directly connected to your Internet gateway or both connected to a dedicated hub/switch.

If your are in the situation “B” things are quite simple, it will be sufficient configure your NethServer NICs with same IP addresses of your firewall WAN and LAN interfaces and precisely:

  • NethServer’s first NIC IP address = your firewall LAN interface IP address
  • NethServer’s second NIC IP address = your firewall WAN interface IP address
    When all NethServer configurations will be terminated you could turn off your firewall and switch network cables to give it a try, if something doesn’t work you can always switch back network cables.


  1. Boot your PC/server from NethServer installation CD-ROM
  2. At installation menu pick “NethServer interactive install”
  3. Follow step by step basic configuration wizard

#####During step by step basic configuration wizard pay attention to just one point: network configuration is referred to LAN, you will be able to configure the second NIC later from administration Web interface.


  1. Point your web browser to https://IP-address-you-entered:980 and when prompted accept to continue with the non secure site, the warning is just because NethServer uses a self-signed SSL certificate.
  2. To logon enter root as username and password you specified during interactive install (version 6.5) or the default password Nethesis,1234 (version 6.6)
  3. You will display NethServer Dashboard with administration menu on the left
  4. Install mail-server from Package manager then click on Apply button located either on the top or bottom of the page
  5. Ignore optional services installation because your server should just filter emails then forward (or not) them to the rear mailserver, eg. MS Exchange. Click on the “Proceed installation” button at the bottom of the page.
  6. Wait until progression bar reaches 100% and you will be notified that package installation is completed.
  7. Click on the Email section on the left menu then on the right click “Create new domain” button of the Domains tab.
  8. In the domain filed enter your domain (eg. and optionally a brief description.
  9. Click on the “Relay to another server” radio button.
  10. Input IP address of your internal mail server, eg. your MS Exchange server.
  11. Ignore disclaimer check box.

Don’t forget to enable appropriate filter options.
The Mailboxes tab could be ignored if all domains are set to deliver to other server.
You could have multiple exchanges behind a single NethServer.
This is right, but the mail-server includes also LDAP, IMAP and POP
services that maybe are not required in this scenario.

Many thanks to @alefattorini @davidep @filippo_carletti for encouragements and support (and corrections ;-)) they gave to me.


WOW impressive @sitz! This is an huge work! Tomorrow I will shoot it on zillions of social network :smiley:
Best howto ever :wink: :+1::+1::+1::+1::+1::+1:


Wow @sitz great popularity here! 160 views in only two days. Your HowTo rocks :wink:


Thank you very much!

1 Like

Hi Sitz this is planned in a escenario where nether is border firewall right?

what if nethserver is just another server in the lan for example.

Firewall inet ip
firewall internal ip

nether ip


How i tell my email server to forward all mail to nether instead of the gateway ?

The point 9 relay will allow nether to get emails from my internal.

This is a real escenario that i’m trying :smiley:

Hi Martin @mabeleira

originally I created this post for an other purpose and there are some dark spots :grin:
I’m going to create an howto based on this post, more technical oriented.

Can you wait few days?

Sure i might help you with it because, i’m trying in this week.

1 Like

Proxy smtp works like a charm but just for inbound email, for outbound email NethServer block port 25 and you have to use him on submission authenticated port 587. In this way your emails could be filtered :wink:
Or you can bypass port 25 just for your mail server using a firewall rule

1 Like


So good document, However, I have some question about DNS MX, should be point to the gateway, right ? how about DKIM, should be configure on Mail Server or the Gateway ? and how set auto learn for Anti SPAM?

Thank you

A post was split to a new topic: Emails bounced between the servers

Sorry for the late response but @sitz is a bit busy :slight_smile:
Yes, DNS MX should be point to the mailserver

That’s a great discussion with a bunch of useful suggestions

Check this, it should answer your question

1 Like

Very good!

Nethserver as antispam antivirus mail gateway works stable and so good for protection.


You got it :slight_smile: :zap: