System/Advanced/Notifications/Email ... "Test SMTP Settings" - no emails
-
@stephenw10 Thanks for your help.
6 igbs yes, and the one re (realtek) nic is only used for sync. It seems to handle that ok.
Concerning the email problem, I have someplace to start with the predictable failure at the firewall, I will fuss with it and probably eventually fix it. I have route, and traceroute to help me. I will do some packet capture too. It will be an opportunity to learn BSD better.
The pfSense servers are themselves solid and I have access to the logs over the tunnels. There are much worse headaches.
Thanks for your help.
Roy
-
This post is deleted! -
@reberhar Hello Steve,
I have been trying to get back to this firewall email failure through my OPENVPN tunnels.
I have been tinkering with it and noted that if I restart the tunnels, the client and sometimes the server, the emails work for a few minutes, and then they fail. I am going to try to study the routing table before and after, but I don't think that is changing.
I know that I need to fool with the system routing table carefully. I have found several ways to hang up the tunnels and even bomgar. Once, when I switched to TLS, I hung up the LAN on a server 2000 miles away.
On the positive side, I have learned how to make IPSEC work with OPENVPN, which, for me is helpful.
I am going to be checking the system patches that I have installed. I haven't noted anything in the logs, but will be checking again. Maybe I need to bump up the verbosity of the logs.
I checked the floating rules and didn't notice anything.
Does anything ring a bell with you?
Roy
-
Not really. I've never tried to send email over VPN though. But I would expect it to work as long as the system route to the email server is via the VPN gateway.
-
-
@reberhar Hi Steve,
So I have chased this problem and have found some helpful information, at least for me.
The network administrator before me setup individual OpenVPN site to site server tunnels for every remote connection. This was with shared certificates. There were 4 servers. Everything worked fine with the Email from the servers. Each route was unique with unique port numbers.
Enter the deprecation of shared certificates in OPEN VPN in pfSense and the threat of and update that would not include my install. We were directed to change to TLS.
So I reseached how to make the change and decided to use only one server which works fine execpt for this one glitch, of which I was unaware.
Open VPN does not keep multiple localhost connections alive. If I restart the openvpn the localhost works on whatever server sends mail first. As soon as a different remote unit sends mail, the first connection is lost until another openvpn restart.
It does not treat the same problem but something related.
Since I don't want to create 3 more openvpn servers I am going to switch to an external email server.
-
Hmm, well that second link seems quite clear but I don't think it applies to your situation. You're not trying to access services across the tunnel.
The first link is less clear. It seems to imply that OpenVPN takes traffic destined for localhost on the same box. And that if it fails the localhost traffic also fails. Which applies to you when trying to send an email to the sendmail service. But I'm not sure how that would affect different clients differently...
-
@stephenw10 Hi Steve,
No, neither one applies directly. The second one especially. It just showed that someone tried to fix a similar problem on Linux.
What is clear is that OpenVPN treats Localhost differently than a standard ipv4 or ipv6 number.
Of course that IP number is always the same no matter what machine. So localhost is a separate case. it was never meant to be an endpoint from outside the machine ... if I really understand its function correctly.
I will delete the second link.
-
Hmm, wait are you saying that when you set the clients to route all traffic over the VPN that grabs localhost traffic somehow? But it still works as long as the tunnel stays up?
That wouldn't apply to the server end if so. Maybe I've misread that....
-
@stephenw10 Hi Steve,
The post I include shows how Openvpn changes the BSD routing table. I still have to look at mine again and compare them.
I am however, reticent, to tweak the system at this level. Persistence is certain to be a problem.
As I type this, I guess what I really need to do is dive into the BSD documentation and just learn this stuff.
One thing is certain, OpenVpn does not necessarily maintain a stable dependable connection at the Localhost level.
This seems obvious.
Roy
-
@stephenw10 Only the pfSense email connection drops.
I have an email server internally.
-
Yeah, it seems likely there is is something more subtle at work here because it would break a lot of other things if localhost became completely inaccessible.
-
@stephenw10 Truly.
The routing table in BSD is sending the email query to the OpenVPN gateway address.
The next place to look is in OpenVPN, then the email server.
Now to try to find time to figure out what is happening in OpenVPN.
I wish there was a way to send these messages through the LAN interface. Then there would be a unique IP arriving at the email server. Making LAN a gateway creates a potential infinite loop.
Here is part of the Dovecot log. I wish it had more information.
My wife says that I am "too persistent." Maybe I just need to take the easy way around this obscure problem and just delete this post. Nuts, I like clean resolutions.
Dec 11 01:33:16 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18233, secured, session=<0aj3cvoosop/AAAB>
Dec 11 01:33:16 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360
Dec 11 12:01:06 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=19902, secured, session=<upJDOAMpuox/AAAB>
Dec 11 12:01:06 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360The ne is in OpenVPN.
Dec 11 12:01:39 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=19912, secured, session=<8vo8OgMpvIx/AAAB>
Dec 11 12:01:39 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360
Dec 11 12:03:51 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=19924, secured, session=<DNsjQgMpvox/AAAB>
Dec 11 12:03:51 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360
Dec 11 12:05:00 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=19935, secured, session=<U/48RgMpwIx/AAAB>
Dec 11 12:05:00 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360
Dec 11 12:05:49 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=19951, secured, session=<bq0lSQMpxox/AAAB>
Dec 11 12:05:49 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360
Dec 11 12:06:46 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=19963, secured, session=<PbSPTAMpyIx/AAAB>
Dec 11 12:06:46 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360
Dec 12 01:33:09 catalina-sme dovecot: imap-login: Login: user=<roy>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=21469, secured, session=<pvRokA4pUo9/AAAB>
Dec 12 01:33:09 catalina-sme dovecot: imap(roy): Connection closed (No commands sent) in=0 out=360 -
This post is deleted! -
Hmm, that's from a local smtp server?
-
@stephenw10 Yeah, from the email server. So I looked at the BSD side of things. Looks like pfSense might be writing a script and connecting by the commandline with the info from the GUI, like using SMTP.
I haven't chased i down to the actual code.
So this is something I don't think there is a solution for easily.
If I fuss with it I might be able to tweak the system somehow, but it is a bad idea. It would go away with an update.
-
Hmm, well I always think more info is better even if it documents a failure.
-
@stephenw10 I guess I was probing to see if you wanted me to leave it in the forum.
I thought of writing a patch, but I am unsure if that is the right thing to do.
Roy
-
Hmm, those logs have me confused though. You have an internal email server and that's still failing?
-
Why are you showing imap connections :
@reberhar said in System/Advanced/Notifications/Email ... "Test SMTP Settings" - no emails:
xxxx-sme dovecot: imap-login: Login:
while the issue is smtp ?
