SMTP Out being blocked
-
@nabberuk said in SMTP Out being blocked:
I can't find much on TCP:SEC
SYN and the EC just means ECE, CWR were also set..
-
Packet capture with a filter for port 465. This looks normal.
16:05:09.928638 IP [external_IP].9908 > 64.233.184.109.465: tcp 0
16:05:12.942825 IP [external_IP].9908 > 64.233.184.109.465: tcp 0
16:05:18.953456 IP [external_IP].9908 > 64.233.184.109.465: tcp 0
16:05:28.633324 IP [external_IP].56949 > 64.233.184.109.465: tcp 0
16:05:31.639172 IP [external_IP].56949 > 64.233.184.109.465: tcp 0
16:05:37.647045 IP [external_IP].56949 > 64.233.184.109.465: tcp 0 -
@nabberuk yeah SEC is not anything odd.. Depend on what your application is setting.
But you can clearly see traffic is leaving.. Just not getting any answers.. Which has nothing to do with pfsense.. Is your wan IP different? Maybe they don't want to talk to that IP, or maybe your isp is blocking.. But clearly from your sniff your sending that traffic out.. You getting an answer is out of pfsense control.
-
@johnpoz Thanks.
I shall further investigate. I am using multiple WAN IP addresses but can't see any settings that would affect this.
-
@nabberuk I did a simple nmap from pfsense to that IP... And I show it answering on the 465 port.
Running: /usr/local/bin/nmap -sS -P0 -e igb1 '64.233.184.109' Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-21 10:14 CST Nmap scan report for wa-in-f109.1e100.net (64.233.184.109) Host is up (0.11s latency). Not shown: 996 filtered ports PORT STATE SERVICE 465/tcp open smtps 587/tcp open submission 993/tcp open imaps 995/tcp open pop3s Nmap done: 1 IP address (1 host up) scanned in 10.48 seconds -
@johnpoz It works fine from my home connection, just not in our colocation dc. I have raised a query with them to see if they are blocking anything.
Doing an nmap i get the following. Interestingly i can ping that IP from pfsense. Seems to be someone if blocking it upstream.
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-21 16:20 GMT setup_target: failed to determine route to 64.233.184.109 WARNING: No targets were specified, so 0 hosts scanned. Nmap done: 0 IP addresses (0 hosts up) scanned in 0.03 seconds -
@nabberuk said in SMTP Out being blocked:
just not in our colocation dc
Yeah quite possible they don't let that sort of traffic out? Or could be gmail is blocking your IP because it sends just spam ;)
But your clearly sending it - so something upstream is blocking it, or its getting there and your just not getting back an answer.. All of which has nothing to do with pfsense.
-
@nabberuk said in SMTP Out being blocked:
failed to determine route to 64.233.184.109
Where did you run that nmap?
-
@johnpoz from pfsense (diag > command prompt) after installing the package.
Now ran it from the nmap option. think its defiantly being blocked upstream.
Running: /usr/local/bin/nmap -sS -P0 -e igb0 '64.233.184.109' Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-21 16:31 GMT Nmap scan report for wa-in-f109.1e100.net (64.233.184.109) Host is up (0.0096s latency). Not shown: 998 filtered ports PORT STATE SERVICE 993/tcp open imaps 995/tcp open pop3s Nmap done: 1 IP address (1 host up) scanned in 6.53 seconds -
@nabberuk did you pick your interface? I would think pfsense should of been able to figure out which interface to send the traffic.. but maybe you have something odd setup with your routing.
Was that sniff you saw going out your wan - you sure that is the correct "wan" to be able to get there?
edit: so you can see other open ports (get answers) but not 465 - interesting..
