Done.

Just config more at firewall.

Thank you

1. Enable Proxy Protocol at ELB
http://docs.aws.amazon.com/elasticloadb … tocol.html
port I enable
10995
10993

2. go to security allow 10995 10993
3. iptables allow port
iptables -A INPUT -p tcp -m tcp --dport 10995 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 10993 -j ACCEPT
service iptables save
4. nano /etc/dovecot/dovecot.conf

service imap-login {

       inet_listener {
         haproxy = yes
         port = 10993
         ssl = yes
       }
    }

then restart

http://wiki2.dovecot.org/HAProxy

5. change ELB listener
993 -> 10993
995 -> 10995
done.

According to your configuration, seems ELB is based on HAProxy.

Search "haproxy" here:
http://www.postfix.org/postconf.5.html

Our cluster solution uses HAProxy too, and it works.

You better search 'haproxy' more times in that postfix doc page

You already found the parameters:

smtpd_upstream_proxy_protocol=haproxy
postscreen_upstream_proxy_protocol=haproxy

The key is, use "postscreen_upstream_proxy_protocol" for postscreen service, use "smtpd_upstream_proxy_protocol" for smtpd service. Don't use them both for one service.

That's it, simple?

Help very close now but ssl error

10465 inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o content_filter=smtp-amavis:[127.0.0.1]:10026
  -o smtpd_upstream_proxy_protocol=haproxy

SSL_accept error from mail-oi0-f44.google.com[209.85.218.44]: lost connection

another error

connect from unknown[unknown]
Jan  7 00:05:12 mx2 postfix/smtps/smtpd[13552]: disconnect from unknown[unknown]
Jan  7 00:05:12 mx2 postfix/smtps/smtpd[13552]: warning: haproxy read: unexpected protocol header: \22\3\1\0\143\1\0\0\139\3\3\135\226\\f\219\0CN\188\162\167\140\1473d\234\23\31\23$
Jan  7 00:05:12 mx2 postfix/smtps/smtpd[13552]: connect from unknown[unknown]

For submission, we have:

submission inet n       -       n       -       -       smtpd
  ...
  -o smtpd_upstream_proxy_protocol=haproxy

On frontend server, HAProxy listens on port 587 (submission), and balance the requests to iRedMail servers. like this:

listen submission
    bind :587
    balance leastconn
    option tcp-check
    tcp-check connect send-proxy
    tcp-check expect rstring ^220

    server cont1 cont1.xxx.com:587 check send-proxy ...
    server cont2 cont2.xxx.com:587 check send-proxy ...
    server cont3 cont3.xxx.com:587 check send-proxy ...

It works well for us.

If you have postscreen enabled, postscreen is listening on port 25 instead of the normal smtpd service, so add 'postscreen_upstream_proxy_protocol = haproxy' in main.cf.

I have search issue and they said to uncomment postscreen

#smtp      inet  n       -       n       -       1       postscreen

Can I do that?

Maybe miss understood.

I have use 587 with haproxy for 10 hours and it error.
Don't know why? and have search they said I have to uncomment

#smtp      inet  n       -       n       -       1       postscreen

I have normal iredmail fresh install setting

Hello,

I am facing the same issue, my topology like this one,
Could you please give me advise how to fix it? Thanks a lot

External --------> (listen on 25, 587, 993) HAProxy ------>FWD (port 2525, 587, 10143) -----> iredmail

<<HAProxy.conf>>

listen submission
    bind public_ip:587
    balance leastconn
    option tcp-check
    tcp-check connect send-proxy
    tcp-check expect rstring ^220

server ired iredmail_ip:587 check send-proxy

frontend f_srvc_imap
    bind public_ip:143
    mode tcp
    default_backend b_srvc_imap

backend b_srvc_smtp
    mode tcp
    no option http-server-close
    log global
    option tcplog
    timeout server 1m
    timeout connect 5s
    server ired iredmail_ip:2525 send-proxy

<<master.cf>>
#<Section submission>

# Submission, port 587, force TLS connection.
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o content_filter=smtp-amavis:[127.0.0.1]:10026
  -o smtpd_upstream_proxy_protocol=haproxy

#<Section haproxy-smtp>

2525     inet  n       -       -       -       1       postscreen
-o postscreen_upstream_proxy_protocol = haproxy
-o postscreen_upstream_proxy_timeout = 50s

Postfix log showing as below (172.30.200.201 is Ip address on HAProxy)

Oct 17 06:06:28 snow postfix/submission/smtpd[2429]: disconnect from unknown[172.30.200.201] commands=0/0
Oct 17 06:06:31 snow postfix/submission/smtpd[2429]: connect from unknown[172.30.200.201]
Oct 17 06:06:31 snow postfix/submission/smtpd[2429]: lost connection after CONNECT from unknown[172.30.200.201]
Oct 17 06:06:31 snow postfix/submission/smtpd[2429]: disconnect from unknown[172.30.200.201] commands=0/0
Oct 17 06:06:33 snow postfix/submission/smtpd[2429]: connect from unknown[172.30.200.201]
Oct 17 06:06:33 snow postfix/submission/smtpd[2429]: lost connection after CONNECT from unknown[172.30.200.201]
Oct 17 06:06:33 snow postfix/submission/smtpd[2429]: disconnect from unknown[172.30.200.201] commands=0/0
Oct 17 06:06:35 snow postfix/submission/smtpd[2429]: connect from unknown[172.30.200.201]
Oct 17 06:06:35 snow postfix/submission/smtpd[2429]: lost connection after CONNECT from unknown[172.30.200.201]
Oct 17 06:06:35 snow postfix/submission/smtpd[2429]: disconnect from unknown[172.30.200.201] commands=0/0
Oct 17 06:06:37 snow postfix/submission/smtpd[2429]: connect from unknown[172.30.200.201]