Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Send Mail with attachment fails only from Linux Clients

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vindenesen
      last edited by

      Hi Stoeffel,

      Some questions:

      1. What error message (if any) do you get in Thunderbird? And to clarify, it works when you don't have an attachment or link in the email?
      2. What extra packages have you installed on the firewall? (Squid, snort, antivirus etc.)
      3. Could you take a screenshot of your firewall log just after you have tried to send one of those emails that fails? Remember that, by default, the newest entries are at the bottom.
      4. Screenshot of your firewall rules on the LAN interface?

      Support the project by buying a Gold Subscription at https://portal.pfsense.org
      Running pfSense on SuperMicro A1SRI-2758F with ESXi 5.5

      1 Reply Last reply Reply Quote 0
      • S
        Stoeffel
        last edited by

        Hi vindenesen

        Thanks for reply  :)

        1. I get a SMTP Server timeout Error
        2. Only snort, but snort is not enabled yet
        3. See attachment for Firewall.log, 192.168.1.14 is the Mail sending Linux Client
        4. See attachment for Rules.png

        Rules_on_LAN.png
        Rules_on_LAN.png_thumb
        Firewall_log.png
        Firewall_log.png_thumb

        1 Reply Last reply Reply Quote 0
        • KOMK
          KOM
          last edited by

          Hmm.  The rules are processed first-match, top-down, so it did not match the LAN Net rule and got blocked by the * rule.  Can I ask for your LAN details, IP address & netmask?

          1 Reply Last reply Reply Quote 0
          • V
            vindenesen
            last edited by

            The IP address 173.194.70.104 belongs to Google. I've seen similar at my firewall also, mostly from my Android smartphone. Out-of-state traffic most likely, probably not related. Gmail uses port 465 for SMTP traffic.

            I'm not that familiar with snort, but have you tried to remove the package? And you are sure of that it works when you don't have an attachment or a link in your email?

            You could also perform packet capture (Diagnostics) on WAN, and filter the capture on the SMTP port and SMTP server IP address you are using, just to see if you even get any replies back when you try to send an email.

            Support the project by buying a Gold Subscription at https://portal.pfsense.org
            Running pfSense on SuperMicro A1SRI-2758F with ESXi 5.5

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              Running this command for pfctl will show the Rule Numbers where you can see which Rule caused the Block:

              [  [b]pfctl -vv -sr  ]

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • S
                Stoeffel
                last edited by

                Hello together

                @KOM: Lan is simple; 192.168.1.1/24, 255.255.255.0, Gateway 192.168.1.1 (PFSense), All IPs are fixed

                @vindenesen: I use SMTP at bluewin.ch, Port is also 465. I removed now snort package completly without any positive effect. Yes it works without Attachments, but with huge text it will disapear.

                If I ping the SMTP Server from a Linux Client then i get following output:
                somebody@anylinux:~$ ping smtpauths.bluewin.ch
                PING smtpauths.bluewin.ch (195.186.227.54) 56(84) bytes of data.
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=5 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=7 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=11 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=12 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=14 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=15 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=17 Packet filtered
                From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=18 Packet filtered
                ^C
                –- smtpauths.bluewin.ch ping statistics ---
                18 packets transmitted, 0 received, +8 errors, 100% packet loss, time 17038ms

                Captured Packets on WAN Iface while sending Email from 192.168.1.7:

                22:54:13.829064 IP 195.186.99.54.465 > 85.4.139.0.15357: tcp 37
                22:54:13.829211 IP 195.186.99.54.465 > 85.4.139.0.15357: tcp 0
                22:54:14.345066 IP 195.186.99.54.465 > 85.4.139.0.15357: tcp 37
                22:54:15.374248 IP 195.186.99.54.465 > 85.4.139.0.15357: tcp 37
                22:54:16.353540 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.377973 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 0
                22:54:16.378221 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.378417 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 183
                22:54:16.403148 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 0
                22:54:16.403566 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 1460
                22:54:16.403831 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.403860 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 1460
                22:54:16.404000 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 591
                22:54:16.404144 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.404169 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.405621 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 326
                22:54:16.437979 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 59
                22:54:16.438976 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 85
                22:54:16.477533 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.486416 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 90
                22:54:16.511420 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 181
                22:54:16.511664 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.603680 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 90
                22:54:16.628478 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 117
                22:54:16.628878 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 0
                22:54:16.629437 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 122
                22:54:16.666661 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 69
                22:54:16.667290 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 106
                22:54:16.743410 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 69
                22:54:16.745774 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 106
                22:54:16.774880 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 85
                22:54:16.777326 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 74
                22:54:16.802202 IP 195.186.227.54.465 > 85.4.139.0.19164: tcp 85
                22:54:16.804047 IP 85.4.139.0.19164 > 195.186.227.54.465: tcp 1250

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @Stoeffel:

                  If I ping the SMTP Server from a Linux Client then i get following output:
                  somebody@anylinux:~$ ping smtpauths.bluewin.ch
                  PING smtpauths.bluewin.ch (195.186.227.54) 56(84) bytes of data.
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=5 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=7 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=11 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=12 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=14 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=15 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=17 Packet filtered
                  From 2-227-186-195.bluewin.ch (195.186.227.2) icmp_seq=18 Packet filtered
                  ^C
                  –- smtpauths.bluewin.ch ping statistics ---
                  18 packets transmitted, 0 received, +8 errors, 100% packet loss, time 17038ms

                  Looks like that site is Blocking you "Packet Filtered"

                  http://serverfault.com/questions/61161/how-does-ping-know-that-my-packets-are-filtered

                  I tried to ping that address and it seems they don't accept pings?
                  ping 195.186.227.54
                  PING 195.186.227.54 (195.186.227.54): 56 data bytes
                  ^C
                  –- 195.186.227.54 ping statistics ---
                  8 packets transmitted, 0 packets received, 100.0% packet loss

                  But it does accept connection on port 25
                  telnet 195.186.227.54 25

                  Trying 195.186.227.54…
                  Connected to 54-227-186-195.bluewin.ch.
                  Escape character is '^]'.
                  220 zhhdzmsp-smta14.bluewin.ch ESMTP Service ready

                  and on Port 465
                  telnet 195.186.227.54 465

                  Trying 195.186.227.54…
                  Connected to 54-227-186-195.bluewin.ch.
                  Escape character is '^]'.

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    Googling "SMTP Server timeout Error thunderbird and attachments"

                    Seems like several possible issues:

                    https://support.mozilla.org/en-US/questions/988025
                    https://bugzilla.mozilla.org/show_bug.cgi?id=541367
                    http://forums.mozillazine.org/viewtopic.php?f=39&t=1971101

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • S
                      Stoeffel
                      last edited by

                      Hello BBcan177

                      ..got little more expirience with ping  ;)

                      I don't think it's a Thunderbird problem because it works well with Thunderbird on Windows in the same Network.
                      But I found an other interesting fact. Sending a post on this side is also not possible from Linux clients, windows clients
                      have no problem with that. I use FF in the same version on all PC's.
                      I did a Speedtest at http://hsi.bluewin.ch/speedtest/?language=en with the result that i got a uploadspeed of 0kBit/s, downloadspeed is normal with 41557kBit/s

                      1 Reply Last reply Reply Quote 0
                      • V
                        vindenesen
                        last edited by

                        Seems like large outgoing traffic is blocked somewhere. Could it be a problem with packet fragmentation? Have your tried to lower the MTU on one of your Linux-based clients?

                        Support the project by buying a Gold Subscription at https://portal.pfsense.org
                        Running pfSense on SuperMicro A1SRI-2758F with ESXi 5.5

                        1 Reply Last reply Reply Quote 0
                        • S
                          Stoeffel
                          last edited by

                          Hello vindenesen

                          Yes you got right.  An MTU Size of 1500 on the WAN Iface solved the problem. As I configured the WAN Iface of my PFSense I read on several forums that the MTU size over the Bluewin VDSL line must be less than 1492 bit. So I put this value in. Now I checked the max. Transmission unit size with my old router (MTU Size is not visible in settings) with ping and I figured out that a package until 1472 data bits go thru without fragmentation. I read on Wikipedia that the Headers are together 28bit. So 1500 shut be possible. On my Linux clients the MTU Value is 1500 and this wasn't a problem befor. Dear vindenesen, thanks a lot to push me to the solution.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.