内部网络环境通过nginx代理访问阿里云邮箱

一、整体思路

在客户端如foxmail将SMTP和POP3/imap服务器设置为内部NGINX的IP，NGINX将请求转发到阿里的对应服务器。NGINX的代理配置如下：

1、stream方式：

#user nobody;
worker_processes 4;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;
#tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

#gzip on;

# server {
# listen 8080;
# server_name localhost;

# #access_log logs/host.access.log main;

# location / {
# root html;
# index index.html index.htm;
# }

#error_page 404 /404.html;

# redirect server error pages to the static page /50x.html
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# root html;
# }
# }

}

stream {

log_format proxy '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'$ssl_protocol $ssl_cipher';
access_log logs/stream.log proxy;
#error_log logs/stream_error.log debug;
open_log_file_cache off;

# 1. 代理 SMTP 发信服务 (端口 465 或 587)
upstream backend_smtp {
server smtp.qiye.aliyun.com:465; # 阿里企业邮箱 SMTP 服务器
}
server {
listen 465 ssl; # Nginx 监听的端口，Foxmail 将连接此端口
proxy_pass backend_smtp;
proxy_connect_timeout 60s;
proxy_timeout 60s;

ssl_certificate proxy.crt;
ssl_certificate_key proxy.key;
ssl_protocols TLSv1.2 TLSv1.3;

proxy_ssl on;
proxy_ssl_server_name on;
proxy_ssl_name smtp.qiye.aliyun.com;
proxy_ssl_verify off;
}

# 2. 代理 POP3 收信服务 (端口 995)
upstream backend_pop3 {
server pop.qiye.aliyun.com:995; # 阿里企业邮箱 POP3 服务器
}
server {
listen 995 ssl;
proxy_pass backend_pop3;
proxy_connect_timeout 60s;
proxy_timeout 60s;

ssl_certificate proxy.crt;
ssl_certificate_key proxy.key;
ssl_protocols TLSv1.2 TLSv1.3;

proxy_ssl on;
proxy_ssl_server_name on;
proxy_ssl_name pop.qiye.aliyun.com;
proxy_ssl_verify off;
}

# 3. 代理 IMAP 收信服务 (端口 993，如果使用 IMAP 协议)
upstream backend_imap {
server imap.qiye.aliyun.com:993; # 阿里企业邮箱 IMAP 服务器
}
server {
listen 993 ;
#listen 993 ssl;
proxy_pass backend_imap;
proxy_connect_timeout 30s;
proxy_timeout 300s;
proxy_buffer_size 16k;
proxy_socket_keepalive on;

#ssl_certificate proxy.crt;
#ssl_certificate_key proxy.key;
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

#proxy_ssl on;
#proxy_ssl_server_name on;
#proxy_ssl_name imap.qiye.aliyun.com;
#proxy_ssl_verify off;
#proxy_ssl_ciphers 'DEFAULT:!DH:!aNULL:!eNULL';
#proxy_ssl_session_reuse on;
}

upstream zhaozhong_imap2 {
server imap-n.global-mail.cn:993; # 兆众 IMAP 服务器
}
server {
listen 2993;
#listen 2993 ssl;
proxy_pass zhaozhong_imap2;
proxy_connect_timeout 60s;
proxy_timeout 60s;
proxy_buffer_size 16k;
proxy_socket_keepalive on;

#ssl_certificate proxy.crt; # 证书文件路径
#ssl_certificate_key proxy.key; # 私钥路径
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

# === 上游 SSL（Nginx 到兆众服务器）===
#proxy_ssl on; # 必须开启
#proxy_ssl_server_name on; # 发送 SNI，必须开启
#proxy_ssl_name imap-n.global-mail.cn; # 指定证书期望的域名
#proxy_ssl_verify off; # 测试时可先关闭验证，确认通后建议开启
#proxy_ssl_ciphers 'HIGH:!DH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA';
#proxy_ssl_session_reuse on;

}

upstream zhaozhong__smtp2 {
server smtp-n.global-mail.cn:465; # 兆众SMTP 服务器
}
server {
listen 2465 ssl ;
proxy_pass zhaozhong__smtp2;
proxy_connect_timeout 60s;
proxy_timeout 60s;

ssl_certificate proxy.crt;
ssl_certificate_key proxy.key;
ssl_protocols TLSv1.2 TLSv1.3;

proxy_ssl on;
proxy_ssl_server_name on;
proxy_ssl_name smtp-n.global-mail.cn;
proxy_ssl_verify off;
proxy_ssl_ciphers 'HIGH:!DH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA';
proxy_ssl_session_reuse on;
}

}

2、证书生成方法

 

C:\Program Files\OpenSSL-Win64
cd C:\nginx\conf
# 生成私钥
openssl genrsa -out proxy.key 2048
# 生成证书（直接生成，跳过 CSR 步骤，更简单）
openssl req -x509 -new -key proxy.key -out proxy.crt -days 365 -subj "/CN=mail-proxy.local"

 

 

 

2.http-server方式

需搭配内部DNS：

配置后续补充