SMTP STARTTLS not advertised on port 25
-
Hi,
We've got a set of servers in LAN offering public services via NAT using a combination of Virtual IP + 1:1 and Port Forwarding rules.
I've got a small alias list of email-relevant ports for 25, 993 and 587, using that alias in the Port Forwarding rule to redirect from WAN address to our internal email server.Using telnet from an external source (emulating another SMTP server) to port 25 doesn't offer the STARTTLS option, whereas the same test when connected to port 587 does.
The port 25 session:
[alec@quietmonster ~]$ telnet zimbra1.copeohs.com 25 Trying 91.151.8.53... Connected to zimbra1.copeohs.com. Escape character is '^]'. 220 zimbra1.copeohs.com ESMTP Postfix ehlo PWS3.mxtoolbox.com 250-zimbra1.copeohs.com 250-SIZE 47185920 250-VRFY 250 DSN quit 221 2.0.0 Bye Connection closed by foreign host.
The port 587 session:
[alec@quietmonster ~]$ telnet zimbra1.copeohs.com 587 Trying 91.151.8.53... Connected to zimbra1.copeohs.com. Escape character is '^]'. 220 zimbra1.copeohs.com ESMTP Postfix ehlo PWS3.mxtoolbox.com 250-zimbra1.copeohs.com 250-PIPELINING 250-SIZE 47185920 250-VRFY 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN quit 221 2.0.0 Bye Connection closed by foreign host.
If I telnet to our server from a LAN IP to port 25, we see STARTTLS offered:
220 zimbra1.copeohs.com ESMTP Postfix EHLO PWS3.mxtoolbox.com 250-zimbra1.copeohs.com 250-PIPELINING 250-SIZE 47185920 250-VRFY 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Could this difference on port 25 be something to do with my pfSense NAT/rules configuration?
System version updated to 2.4_release last week, but this issue was occurring on the previous 2.3 also. Add-ons: We have OpenVPN client export, Snort and pfBlockerNG (PFB set to some limited GeoIP country blocking).
I can provide further details on our particular rules/config if required.
Thanks for any suggestions.
-
Finally sorted this problem.
Just in case anyone else encounters a similar issue, for us it was our Untangle server, which in our config sits behind the pfSense system on the LAN side (Untangle using transparent bridge mode) that we use to add first-round anti-spam and anti-phishing protection.
The anti-spam lite module has a control option under "Advanced SMTP settings" for enabling/disabling use of TLS, labelled as "Allow and ignore TLS sessions". Ticking that option corrected the problem - we now see the expected STARTTLS option advertised on port 25 again.