Outbound Telnet not working
-
Looking for ideas on my firewall settings.
I can telnet to my machine from remote. But when I try to telnet out it is not successful. Here is my result:
From my machine (10.10.10.100)
:~$ telnet smtp-relay.gmail.com
Trying 142.250.9.28...
Trying 2607:f8b0:4002:c11::1c...
telnet: Unable to connect to remote host: Cannot assign requested addressI tried to capture some tcpdump, I thought it might help troubleshooting in this post (I can't make sense of it)
10:21:45.132184 IP 10.10.10.100.47286 > dns.google.domain: 8143+ A? smtp-relay.gmail.com. (38)
10:21:45.132323 IP 10.10.10.100.47286 > dns.google.domain: 15552+ AAAA? smtp-relay.gmail.com. (38)
10:21:45.142631 IP dns.google.domain > 10.10.10.100.47286: 8143 1/0/0 A 142.250.9.28 (54)
10:21:45.144074 IP dns.google.domain > 10.10.10.100.47286: 15552 1/0/0 AAAA 2607:f8b0:4002:c11::1c (66)
10:21:45.145789 IP 10.10.10.100.50436 > yq-in-f28.1e100.net.telnet: Flags [S], seq 1663070314, win 29200, options [mss 1460,sackOK,TS val 4294948203 ecr 0,nop,wscale 7], length 0
10:21:46.146618 IP 10.10.10.100.50436 > yq-in-f28.1e100.net.telnet: Flags [S], seq 1663070314, win 29200, options [mss 1460,sackOK,TS val 4294948453 ecr 0,nop,wscale 7], length 0
10:21:48.147416 IP 10.10.10.100.50436 > yq-in-f28.1e100.net.telnet: Flags [S], seq 1663070314, win 29200, options [mss 1460,sackOK,TS val 4294948954 ecr 0,nop,wscale 7], length 0
Searching thru the forum, I did find one suggestion that might help me, but I am not sure which setting I need on my end? Here is the suggestion:
"Please check, that you don't have check-mark on "Disable NAT Reflection for port forwards" (found at: System: Advanced: Firewall and NAT and Network Address Translation portion of page)"
In my advanced system settings I have the following, Can you let me know which I should change?:
NAT Reflection mode for port forwards - disabled /PureNat /Nat+Proxy
Enable NAT Reflection for 1:1 NAT - disabled
Enable automatic outbound NAT for Reflection - disabled
-
-
@pfsense1921 said in Outbound Telnet not working:
10:21:45.145789 IP 10.10.10.100.50436 > yq-in-f28.1e100.net.telnet: Flags [S], seq 1663070314, win 29200, options [mss 1460,sackOK,TS val 4294948203 ecr 0,nop,wscale 7], length 0
why would you think they would allow you to telnet to them, telnet is port 23... Are you trying to test if you can send mail there via smtp which would be port 25 via telnet?
Pretty much promise you they do not listen on the telnet port of 23..
example
root@localhost:~# telnet 142.250.9.28 Trying 142.250.9.28... ^C root@localhost:~# telnet 142.250.9.28 25 Trying 142.250.9.28... Connected to 142.250.9.28. Escape character is '^]'. 220 smtp-relay.gmail.com ESMTP n13sm142044jat.38 - gsmtpYou can see first to just telnet port 23 just sits there, times out after whatever time - not willing to wait... But if telnet to 25, get a response..
-
@johnpoz
Thank You. I still can not get a response on port 25~$ telnet 142.250.9.28 25
Trying 142.250.9.28...
^CThat is the same response when you try 23
-
@pfsense1921 where are you doing it from? Many an ISP would block outbound 25.. Mine does! to talk on 25 to something I have to use a vps out on the public internet.
If your on some sort of residential/home connection - very high odds they block outbound on 25.. Since a home user would really have no need to talk outbound on 25 other than sending spam.
-
@johnpoz
I have business internet, let me call and ask them. -
@pfsense1921 yeah can not hurt to ask.
Not exactly sure what your wanting to do or check.. But even if your isp blocks 25, and your trying to send mail, you could prob use port 465.. This is going to be a TLS connection, so prob not going to be able to test with just telnet.. Other than just getting an answer and the connection closed
root@NewUC:/home/user# telnet 64.233.184.109 465 Trying 64.233.184.109... Connected to 64.233.184.109. Escape character is '^]'. ehelo Connection closed by foreign host. root@NewUC:/home/user#But you could use a client that supports ssl/tls like the gnutls-cli
root@NewUC:/home/user# gnutls-cli -p 465 smtp-relay.gmail.com Processed 128 CA certificate(s). Resolving 'smtp-relay.gmail.com:465'... Connecting to '142.250.152.28:465'... - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `CN=smtp-relay.gmail.com', issuer `CN=GTS CA 1C3,O=Google Trust Services LLC,C=US', serial 0x00eae57ee88d32a6ac1200000000006064, EC/ECDSA key 256 bits, signed using RSA-SHA256, activated `2022-02-07 03:07:32 UTC', expires `2022-05-02 03:07:31 UTC', pin-sha256="sBAsaZk23/WHalwwCTXc75Dt7+K0NjcjYjQU6h6+P5o=" Public Key ID: sha1:c1945615aff9d358c14d6278776522330fb1d555 sha256:b0102c699936dff5876a5c300935dcef90edefe2b4363723623414ea1ebe3f9a Public Key PIN: pin-sha256:sBAsaZk23/WHalwwCTXc75Dt7+K0NjcjYjQU6h6+P5o= - Certificate[1] info: - subject `CN=GTS CA 1C3,O=Google Trust Services LLC,C=US', issuer `CN=GTS Root R1,O=Google Trust Services LLC,C=US', serial 0x0203bc53596b34c718f5015066, RSA key 2048 bits, signed using RSA-SHA256, activated `2020-08-13 00:00:42 UTC', expires `2027-09-30 00:00:42 UTC', pin-sha256="zCTnfLwLKbS9S2sbp+uFz4KZOocFvXxkV06Ce9O5M2w=" - Certificate[2] info: - subject `CN=GTS Root R1,O=Google Trust Services LLC,C=US', issuer `CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE', serial 0x77bd0d6cdb36f91aea210fc4f058d30d, RSA key 4096 bits, signed using RSA-SHA256, activated `2020-06-19 00:00:42 UTC', expires `2028-01-28 00:00:42 UTC', pin-sha256="hxqRlPTu1bMS/0DITB1SSu0vd4u/8l8TjPgfaAp63Gc=" - Status: The certificate is trusted. - Description: (TLS1.3-X.509)-(ECDHE-X25519)-(ECDSA-SECP256R1-SHA256)-(AES-256-GCM) - Options: - Handshake was completed - Simple Client Mode: 220 smtp-relay.gmail.com ESMTP q20sm1810502plk.149 - gsmtp -
@johnpoz THANK YOU!!!
It was the stupid ISP. They opened it up for me
~$ telnet 142.250.9.28 25
Trying 142.250.9.28...
Connected to 142.250.9.28.
Escape character is '^]'.
220 smtp-relay.gmail.com ESMTP c4sm237147plr.127 - gsmtp -
@pfsense1921 haha - yeah even business connection prob block it unless specific ask for.
If your going to try and send specific mail from this IP, you prob going to need them to make a setting for the PTR record of your IP.. Many MX will not accept mail unless the PTR matches the sending MTA name, etc..
But if your just trying to relay mail through, and gmail will actually be sending the mail on to wherever than your prob ok.
-
Thank You.
I will get my ISP to make a setting for the PTR record of your IP if I can not do it.
-
@pfsense1921 said in Outbound Telnet not working:
PTR record of your IP if I can not do it.
I doubt your ISP delegated control of your IP or IP space to you - but yeah if they did you could change it.. Rare that an ISP would do that - but maybe they have a web interface setup to allow you to manipulate the PTRs for the IPs they gave you - that would be nice! I don't recall ever seeing an ISP doing that ;)
You normally have to actually own the IPs to have access to do that.. When we have delegated some our public space to customers.. We normally maintain control, but there is one customer we did delegate the NS to them, and they run their own NS for their /22 we delegated to them..
-
@johnpoz Thankyou. You are correct
-
Almost complete.
I can telnet to my public static ip 25 externally good
But if I try to telnet to my public static IP 25 from behind pfsense it does not work. What setting am I missing?
-
@pfsense1921 so 25 on your wan I take it forwards to something on your lan? Your mail server, for you to hit your wan IP and get direct to your lan side IP of this server you would need to setup NAT reflection.
But what is the point of that - in what scenario would something on your lan be trying to send mail to your wan IP? If you have something on your lan or lan side networks, why wouldn't they just talk to your servers lan IP or via its fqdn resolve to your local IP.
-
@johnpoz
Issue is I could not send mail to myself or anyone else@mydomain.com -
@pfsense1921 no not really - but what clients would be doing that, wouldn't they just point to your local mailserver any way? They sure wouldn't be needing to resolve your MX record..
Outlook doesn't need to lookup your MX record, they point to their mail server - which should just resolve to the local IP on your local network.
-
Yeah, doubt I would send myself email. I was told if I was behind firewall and I tried to send others email others@mydomain.com they would not get it. It is working now so all good.
Thanks so much for all your help.
