SMTP - Restrict In and Outgoing Traffic to dedicated Interfaces/IPs

This recommended Read should be helpful: https://community.sophos.com/xg-firewall/f/recommended-reads/122602/sophos-xg-how-to-setup-mta-mode-when-you-have-multiple-wan-ports-or-alias-ip-addresses

Sorry for late answer.

Thanks. Solved my problem

I come back to that...

We have a Sophos LAN port with multiple IP Adresses bind to. Mail Server are not on the main IP Network. So it seems that these IP addresses are skipped by the rule. When chossing the original source only the "main IP" is choosable.

Main Sophos LAN is 172.30.1.1.1/24, additinal LAN IP is 172.31.1.1/24, Mailserver is 172.31.1.25/24.

As destination source only LAN 172.30.1.1 is choosable...

Any hint available?

And another unclear fact: I expected the route prio according to the gateway wights. But this is not true. GW 1 is wight 1, GW 2 is weight 10. But in 9 of 10 times GW 2 is used...

The SMTP Log (GUI) allways shows outgoing IP as "" (empty) for outgoing mail. Not very helpfull.

Weight is not Prio. See: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/LoadBalancingWeights.html

You need to configure a extra WAN Gateway for your Alias and configure a IP Host for the SNAT. 

thanks for answer.

What does it mean in detaill:

"You need to configure a extra WAN Gateway for your Alias and configure a IP Host for the SNAT. "??

Take a look at the Recommended read: https://community.sophos.com/xg-firewall/f/recommended-reads/122602/sophos-xg-how-to-setup-mta-mode-when-you-have-multiple-wan-ports-or-alias-ip-addresses

The SNAT should reflect your needed MASQ. 

I changed the LAN IP for the server lan become the main address.

Reading https://community.sophos.com/xg-firewall/f/recommended-reads/122602/sophos-xg-how-to-setup-mta-mode-when-you-have-multiple-wan-ports-or-alias-ip-addresses the last add is: Reboot the system. So is this really needed?