No out going mail using PIA VPN with don't pull routes turned off
-
I would be very surprised if PIA did not block outbound TCP/25 (SMTP).
They do block outbound SMTP. I had them whitelist my hostname and IP address.
-
You need a policy routing rule on DMZ. TCP source mail_server_addr port any Dest any port 25 with the gateway set to the VPN gateway. Just like in viragomann's first reply but setting the VPN as the gateway.
ssh to the mail server and:
telnet smtp.gmail.com 25
What happens?
Also put a policy routing rule exactly the same, except port 80, then from the mail server:
curl ifconfig.io
Do you get your WAN IP or the VPN IP?
If not the VPN post your DMZ rules.
-
I'm not sure how to connect using ssh with putty to my mail server nor the curl ifconfig.io command. After setting a rule for smtp on the DMZ interface I used a utility on hmailserver and ran the diagnostic which resulted in not able to connect to a host. I have attached a file showing this and the rule I setup.
Regards,
-
Looks to me like PIA is really not allowing you to connect out port 25. You will have to run a packet capture on the PIA interface and run your test again. You will probably see TCP SYN packets outbound to PIA and nothing in reply.
-
I ran the capture packet from pfSense and as you said it looks like packets went outbound but nothing in reply. This of coarse was with "Don't Pull Routes" turned off.
I also tried with "Don't Pull Routes" turned on and of coarse the results were different.
Is this issue resolve able? or do I have to live with the fact that if I use "Don't Pull routes" turned on I will be able to send out mail but my WAN IP will be displayed.
-
That makes zero sense at all. The packet is either routed out the correct interface or it is not. Whether it is a 0.0.0.0/0 route or a policy route just does not matter and has zero impact on whether replies are received. You are looking at something incorrectly.
-
Im with derelict here I doubt pia allows sending email on 25.. And lets say they did - how would that work since your PTR is not going to match..
Are you trying to send spam? Sending email needs to come from your valid IP that matches both forward and ptr or many players will just block you anyway. I doubt anyone would accept email from a vpn ip anyway..
-
Thanks fellows for your help up to now, but I need to know if it's possible to achieve my goal. I'm far from being an expert on configuring firewalls or networking. If it's possible then let m know what I need to do. I was told in the past that it was possible.
-
yes it possible to route whatever traffic you want over a vpn connection. But here is the thing that vpn connect needs to allow the traffic you want to send. I would not be surprised if PIA prevents 25 traffic. They are in the business of hiding peoples connections from their isp, being used for geographic circumvention, etc.
Who would route email out through that connection?? Even if they allow it most of the major players would block that.. Simple enough to test, route your traffic over your vpn and see if you can make a connection to some smtp server.
Lets say they do allow it, and where your sending the email doesn't block the vpn IP from sending mail to it. What is your information on your email server. So lets say its mail.domain.tld that resolves to what IP? lets say 1.2.3.4, it sure doesn't resolve to the vpn IP does it lets say 5.6.7.8
Lets say you do all of this, lets say your forward name resolves to the vpn IP, and email comes through there at 5.6.7.8 down the tunnel to your email server. Does the vpn company allow you to modify the ptr on this 5.6.7.8 to say mail.domain.tld - I highly doubt that!! For starters those IPs are shared with all their other customers trying to circumvent geo locations and get netflix from the US for example..
Email really needs to be sent from YOUR actual IP, this IP should be static so not some home isp connection. And you also need to setup the PTR so whatever that IP is resolves to what your mail server says its name is, etc..
You really need to read the RFCs on running a mail server…
-
I was able to finally resolve my issue. After trying to use telnet, ping and tracert commands with no success I finally figured out that I was missing the outbound PIAVPN interface NAT rule for my DMZ source IP range. Even though this did not help to send out mail outbound from my mail server, I was able to use the commands to figure out what worked. Finally I used the mail forwarder in hmailserver to a out.myprovider.com 1025 server from my ISP. Now I happy to say I can send out mail with "don't pull routes" deselected.
