SMTP Out being blocked

nabberuk

We have just migrated our small finance server over to our new colo servers which sit behind a pfsense box.

Our finance software sends remittance slips via SMTP. We use gmail for this but i'm getting a timeout when sending a test one.

What i have looked at;

Firewall rules, nothing should be blocking it. I can see the traffic being passed in the logs (we do not have any traffic shaping setup)
i have tried connecting to gmails SMTP servers via multiple tools on different devices sat behing the pfsense box. All with the same result, I've also tried connecting with the same tools on my laptop (not behind the pfsense box) and it connects fine.

Further Info: I'm running 2.6.

I'm pretty stumped about where the issue is, any pointers? I can't find much on TCP:SEC

nabberuk

@nabberuk

Elsewhere someone mentioned about creating a limiter as it shouldn't be tagged as TCP:SEC.

Is this a viable solution? sounds a bit strange having to create a limiter to allow SMPT out?

johnpoz

@nabberuk that log shows that it was allowed.. So not sure where you get the idea from that it was blocked.

Why don't you just sniff on your wan - do you see the traffic go out.. 10 second test..

johnpoz

@nabberuk said in SMTP Out being blocked:

I can't find much on TCP:SEC

SYN and the EC just means ECE, CWR were also set..

See
https://www.rfc-editor.org/rfc/rfc3168#section-23.2

nabberuk

@johnpoz

Packet capture with a filter for port 465. This looks normal.

16:05:09.928638 IP [external_IP].9908 > 64.233.184.109.465: tcp 0
16:05:12.942825 IP [external_IP].9908 > 64.233.184.109.465: tcp 0
16:05:18.953456 IP [external_IP].9908 > 64.233.184.109.465: tcp 0
16:05:28.633324 IP [external_IP].56949 > 64.233.184.109.465: tcp 0
16:05:31.639172 IP [external_IP].56949 > 64.233.184.109.465: tcp 0
16:05:37.647045 IP [external_IP].56949 > 64.233.184.109.465: tcp 0

johnpoz

@nabberuk yeah SEC is not anything odd.. Depend on what your application is setting.

But you can clearly see traffic is leaving.. Just not getting any answers.. Which has nothing to do with pfsense.. Is your wan IP different? Maybe they don't want to talk to that IP, or maybe your isp is blocking.. But clearly from your sniff your sending that traffic out.. You getting an answer is out of pfsense control.

nabberuk

@johnpoz Thanks.

I shall further investigate. I am using multiple WAN IP addresses but can't see any settings that would affect this.

johnpoz

@nabberuk I did a simple nmap from pfsense to that IP... And I show it answering on the 465 port.

Running: /usr/local/bin/nmap  -sS -P0 -e igb1 '64.233.184.109'
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-21 10:14 CST
Nmap scan report for wa-in-f109.1e100.net (64.233.184.109)
Host is up (0.11s latency).
Not shown: 996 filtered ports
PORT    STATE SERVICE
465/tcp open  smtps
587/tcp open  submission
993/tcp open  imaps
995/tcp open  pop3s

Nmap done: 1 IP address (1 host up) scanned in 10.48 seconds

nabberuk

@johnpoz It works fine from my home connection, just not in our colocation dc. I have raised a query with them to see if they are blocking anything.

Doing an nmap i get the following. Interestingly i can ping that IP from pfsense. Seems to be someone if blocking it upstream.

Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-21 16:20 GMT
setup_target: failed to determine route to 64.233.184.109
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.03 seconds

johnpoz

@nabberuk said in SMTP Out being blocked:

just not in our colocation dc

Yeah quite possible they don't let that sort of traffic out? Or could be gmail is blocking your IP because it sends just spam ;)

But your clearly sending it - so something upstream is blocking it, or its getting there and your just not getting back an answer.. All of which has nothing to do with pfsense.

johnpoz

@nabberuk said in SMTP Out being blocked:

failed to determine route to 64.233.184.109

Where did you run that nmap?

nabberuk

@johnpoz from pfsense (diag > command prompt) after installing the package.

Now ran it from the nmap option. think its defiantly being blocked upstream.

Running: /usr/local/bin/nmap  -sS -P0 -e igb0 '64.233.184.109'
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-21 16:31 GMT
Nmap scan report for wa-in-f109.1e100.net (64.233.184.109)
Host is up (0.0096s latency).
Not shown: 998 filtered ports
PORT    STATE SERVICE
993/tcp open  imaps
995/tcp open  pop3s

Nmap done: 1 IP address (1 host up) scanned in 6.53 seconds

johnpoz

@nabberuk did you pick your interface? I would think pfsense should of been able to figure out which interface to send the traffic.. but maybe you have something odd setup with your routing.

Was that sniff you saw going out your wan - you sure that is the correct "wan" to be able to get there?

edit: so you can see other open ports (get answers) but not 465 - interesting..