Current implementation of mail_forwarder role provides ability for SMTP relay host to connect to local SMTP server, allowing delivery of bounced messages to local accounts.

This scenario works pretty well in case of servers or workstations with static IPs, but does not make much sense for machines which are behind NAT, or machines that often change the IP (such as laptops). In particular:

• Anything behind NAT will normally not be accessible for SMTP delivery anyway.
• Since firewall is configured using hostname, in case a temporary offline machine (laptop) is booted, and network is not available at a time when firewall is coming up, firewall will fail to deploy completely if the SMTP relay host name cannot be resolved.

It would be beneficial if it were possible to explicitly disable opening-up the firewall for external SMTP connections.

The following should be done:

• Implement tests for new functionality.
• Add parameter smtp_from_relay_allowed to mail_forwarder role, defaulting the value to yes.
• Parameter should control whether the incoming connections (via firewall) will be allowed from the SMTP relay or not.
• Update role reference documentation.
• Update usage instructions.