Outbound Telnet not working
-
@johnpoz
I have business internet, let me call and ask them. -
@pfsense1921 yeah can not hurt to ask.
Not exactly sure what your wanting to do or check.. But even if your isp blocks 25, and your trying to send mail, you could prob use port 465.. This is going to be a TLS connection, so prob not going to be able to test with just telnet.. Other than just getting an answer and the connection closed
root@NewUC:/home/user# telnet 64.233.184.109 465 Trying 64.233.184.109... Connected to 64.233.184.109. Escape character is '^]'. ehelo Connection closed by foreign host. root@NewUC:/home/user#But you could use a client that supports ssl/tls like the gnutls-cli
root@NewUC:/home/user# gnutls-cli -p 465 smtp-relay.gmail.com Processed 128 CA certificate(s). Resolving 'smtp-relay.gmail.com:465'... Connecting to '142.250.152.28:465'... - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `CN=smtp-relay.gmail.com', issuer `CN=GTS CA 1C3,O=Google Trust Services LLC,C=US', serial 0x00eae57ee88d32a6ac1200000000006064, EC/ECDSA key 256 bits, signed using RSA-SHA256, activated `2022-02-07 03:07:32 UTC', expires `2022-05-02 03:07:31 UTC', pin-sha256="sBAsaZk23/WHalwwCTXc75Dt7+K0NjcjYjQU6h6+P5o=" Public Key ID: sha1:c1945615aff9d358c14d6278776522330fb1d555 sha256:b0102c699936dff5876a5c300935dcef90edefe2b4363723623414ea1ebe3f9a Public Key PIN: pin-sha256:sBAsaZk23/WHalwwCTXc75Dt7+K0NjcjYjQU6h6+P5o= - Certificate[1] info: - subject `CN=GTS CA 1C3,O=Google Trust Services LLC,C=US', issuer `CN=GTS Root R1,O=Google Trust Services LLC,C=US', serial 0x0203bc53596b34c718f5015066, RSA key 2048 bits, signed using RSA-SHA256, activated `2020-08-13 00:00:42 UTC', expires `2027-09-30 00:00:42 UTC', pin-sha256="zCTnfLwLKbS9S2sbp+uFz4KZOocFvXxkV06Ce9O5M2w=" - Certificate[2] info: - subject `CN=GTS Root R1,O=Google Trust Services LLC,C=US', issuer `CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE', serial 0x77bd0d6cdb36f91aea210fc4f058d30d, RSA key 4096 bits, signed using RSA-SHA256, activated `2020-06-19 00:00:42 UTC', expires `2028-01-28 00:00:42 UTC', pin-sha256="hxqRlPTu1bMS/0DITB1SSu0vd4u/8l8TjPgfaAp63Gc=" - Status: The certificate is trusted. - Description: (TLS1.3-X.509)-(ECDHE-X25519)-(ECDSA-SECP256R1-SHA256)-(AES-256-GCM) - Options: - Handshake was completed - Simple Client Mode: 220 smtp-relay.gmail.com ESMTP q20sm1810502plk.149 - gsmtp -
@johnpoz THANK YOU!!!
It was the stupid ISP. They opened it up for me
~$ telnet 142.250.9.28 25
Trying 142.250.9.28...
Connected to 142.250.9.28.
Escape character is '^]'.
220 smtp-relay.gmail.com ESMTP c4sm237147plr.127 - gsmtp -
@pfsense1921 haha - yeah even business connection prob block it unless specific ask for.
If your going to try and send specific mail from this IP, you prob going to need them to make a setting for the PTR record of your IP.. Many MX will not accept mail unless the PTR matches the sending MTA name, etc..
But if your just trying to relay mail through, and gmail will actually be sending the mail on to wherever than your prob ok.
-
Thank You.
I will get my ISP to make a setting for the PTR record of your IP if I can not do it.
-
@pfsense1921 said in Outbound Telnet not working:
PTR record of your IP if I can not do it.
I doubt your ISP delegated control of your IP or IP space to you - but yeah if they did you could change it.. Rare that an ISP would do that - but maybe they have a web interface setup to allow you to manipulate the PTRs for the IPs they gave you - that would be nice! I don't recall ever seeing an ISP doing that ;)
You normally have to actually own the IPs to have access to do that.. When we have delegated some our public space to customers.. We normally maintain control, but there is one customer we did delegate the NS to them, and they run their own NS for their /22 we delegated to them..
-
@johnpoz Thankyou. You are correct
-
Almost complete.
I can telnet to my public static ip 25 externally good
But if I try to telnet to my public static IP 25 from behind pfsense it does not work. What setting am I missing?
-
@pfsense1921 so 25 on your wan I take it forwards to something on your lan? Your mail server, for you to hit your wan IP and get direct to your lan side IP of this server you would need to setup NAT reflection.
But what is the point of that - in what scenario would something on your lan be trying to send mail to your wan IP? If you have something on your lan or lan side networks, why wouldn't they just talk to your servers lan IP or via its fqdn resolve to your local IP.
-
@johnpoz
Issue is I could not send mail to myself or anyone else@mydomain.com -
@pfsense1921 no not really - but what clients would be doing that, wouldn't they just point to your local mailserver any way? They sure wouldn't be needing to resolve your MX record..
Outlook doesn't need to lookup your MX record, they point to their mail server - which should just resolve to the local IP on your local network.
-
Yeah, doubt I would send myself email. I was told if I was behind firewall and I tried to send others email others@mydomain.com they would not get it. It is working now so all good.
Thanks so much for all your help.
