SMTP port forwarding from internal server
-
@lex-under-3182 said in SMTP port forwarding from internal server:
Just to confirm 192.168.0.139 is SMTP client and 85.13.135.13 is external SMTP server not managed by me.
And how is the client connected to pfSense? To its WAN?
To communicate both need to be within the same subnet. That doesn't seem to be the case. -
I can ping pfsense. Several virtual private cloud networks are connected between each other via so called VPC peering.
But for example if I run
root@192.168.0.139:~# curl ifconfig.co
80.158.48.35I will get back public IP of so called sharedNAT for that network which is not a pfsense server. So default gateway is no pfsense.
Probably I will have to use VPN... I already have one in pfsense for internal that network and outside connections to it. No have to make some kind of outbound VPN... )
It would be cool if I could just route 587 traffic from 192.168.0.139 to mail server through pfsense server... but so far no success (
I feel myself dump)) sorry to bother -
@lex-under-3182 said in SMTP port forwarding from internal server:
I can ping pfsense. Several virtual private cloud networks are connected between each other via so called VPC peering.
I asked for the interface the client connect to pfSense.
But for example if I run
root@192.168.0.139:~# curl ifconfig.co
80.158.48.35I will get back public IP of so called sharedNAT for that network which is not a pfsense server. So default gateway is no pfsense.
So 80.158.48.35 is the public IP when you go out and you try to forward SMTP mails to it??
What is the public IP of pfSense?
-
@stephenw10 Thanks for the reply but probably this is not my case. or I have not understood the setup correctly. I did exactly what was advised but still my telnet sessions do not work on client. May be telnet on 587 port is not correct way to test it? I do see connections in logs.
May be this would work if pfsense was a gateway for that network where client server is BUT it is not(
PFsence and client can communicate between each other via private IP but pfsense has it`s own Public IP and client server has shared NAT for www access. So by default if I run bellow command it tries to route it through that sNAT, if I add iptdables then it will try to route it to 172.28.28.28 587 port .root@192.168.0.139:~# tcptraceroute 85.13.135.13 587
Running:
traceroute -T -O info -p 587 85.13.135.13
traceroute to 85.13.135.13 (85.13.135.13), 30 hops max, 60 byte packets
1 100.78.0.1 (100.78.0.1) 13.399 ms 13.351 ms 13.345 ms
2 172.30.5.89 (172.30.5.89) 6.835 ms 6.875 ms 7.066 ms
3 * * *
4 * * *
5 * * * -
Right you have to use the pfSense WAN IP to access the SMTP server from the client instead of the actual public IP.
That will work as long as you have an outbound NAT rule in pfSense covering the client subnet.
When it's configured correctly the states in pfSense will look like:
WAN tcp 192.168.0.139:56378 -> 85.13.135.13:587 (172.28.28.28:587) WAN tcp 172.28.28.28:49761 (192.168.0.139:56378) -> 85.13.135.13:587Steve
-
@viragomann said in SMTP port forwarding from internal server:
So 80.158.48.35 is the public IP when you go out and you try to forward SMTP mails to it??
What is the public IP of pfSense?I cannot disclose pfsense ip( . but lets say it is 80.158.10.10
80.158.48.35 is a public IP of several hundred servers without public IP. Lets call it Shared SNAT . and it does not allow SMTP ports including 587
I try to forward SMTP connections to pfsense private ip 172.28.28.28 then I though it will automatically send that request through 80.158.10.10 to mail server.
my ifconfig on pfsense
[2.6.0-RELEASE][root@172.28.28.28]/root: ifconfig vtnet0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: WAN options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE> ether fa:16:3e:a9:cb12 inet6 fe80::f816:3eff:fea9:ba12%vtnet0 prefixlen 64 scopeid 0x1 inet 172.28.28.28 netmask 0xffffff00 broadcast 172.28.28.255 media: Ethernet 10Gbase-T <full-duplex> status: active nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> enc0: flags=0<> metric 0 mtu 1536 groups: enc nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384 options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6> inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 inet 127.0.0.1 netmask 0xff000000 groups: lo nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> pflog0: flags=100<PROMISC> metric 0 mtu 33160 groups: pflog pfsync0: flags=0<> metric 0 mtu 1500 groups: pfsync -
@lex-under-3182
I think, I got it.My assumption was, you want to forward mails from any public IP first.
So you can limit the source in the outbound NAT rule to the clients IP then. -
Ok guys I think the issue somewhere on other end of firewall.
When I am adding these settings I do see requests in logs but Firewall is blocking it, so the first though I have is to add Pass rule in firewall like this
https://nimb.ws/WkY0AZThen when I am doing telnet I do see that firewall stops blocking it
https://nimb.ws/8ClMy0And connections times out which is probably means I cannot use 172.28.28.28 as my mail server host in application settings. (
root@vault-test:~# telnet 172.28.28.28 587 Trying 172.28.28.28... telnet: Unable to connect to remote host: Connection timed out -
@lex-under-3182
Strange, the rule should allow the packets.Switch to the nowmal log view, so you can see the rule which blocks the traffic.
-
@viragomann Should I use 587 port under translation area?
https://nimb.ws/NWw75O -
@lex-under-3182
No, that's the source port. I should be dynamic (any).
Only the destination port is 587. -
@viragomann port for source is empty as you can see on last screenshot. For "Translation" should be empty as well? hmm
Does not that mean to route any traffic to any port at 172.28.28.28 from 192.168.0.136 to 85.13.135.13:587 ?If I try to connect to 172.28.28.28:80 then it will masquerade it to 85.13.135.13:587 ?
-
@lex-under-3182
The translation port has to be empty. This is the source port in outgoing packets and should be automatically selected by pfSense. -
Yup, or check the 'static port' box to use the same source port the client is using. Either should work here though.
Steve
-
@stephenw10 @viragomann
Ok guys, thank you for help, but looks like I am stuck with this... It still does not work. May be it is because of some settings in hoster's NAT for pfsense public IP that I do not control.Although from pfsense I can telnet mail server.
/root: telnet 85.13.135.13 587 Trying 85.13.135.13... Connected to dd52114.kasserver.com. Escape character is '^]'. 220 dd52114.kasserver.com ESMTPFrom client's server I cannot
# telnet 172.28.28.28 587 Trying 172.28.28.28... telnet: Unable to connect to remote host: Connection timed outIt is possible there are also some other settings in pfsense that I have not enabled and that prevent this from mapping correctly.
I cannot ask you for any further help. It is not ethical I think) You spent a lot of time helping me... I will try to remove everything and setup again on sunday but I think the issue will be there and I will have to add the second openVPN for this purpose. Connecting each server to VPN to be able to send emails looks not very stable solution for me but I am pretty sure this should work...
In any case if somebody still find an issue in my configs or have another solution then please share.
Just to repeat here is my outbound NAT config
https://nimb.ws/IRHqbn
THis is firewall rule for that NAT
https://nimb.ws/VPYBs3
System - Advanced - Firewall&NAT
https://nimb.ws/O8lYWHBy the way did an upgrade of pfsense to 2.6.0-RELEASE like few weeks ago. And also there is no Translation options in System - Advanced - Firewall&NAT menu. But I doubt it could be the cause.
-
@lex-under-3182
Is the port forwarding rule still in place. It is necessary as well.Are the packets still blocked? If so, what's the responsible rule?
For troubleshooting run a packets capture on pfSense WAN interface, filter for port 587. So you can clearly see what the packets do.
-
Try to connect from the client. Check the states in pfSense.
-
@stephenw10 @viragomann
through VPN it worked fine. Spent 40 mins and issue solved.Just to update. Thanks you guys for help anyway
