Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SMTP notification uses default gateway instead of IPSEC

    Scheduled Pinned Locked Moved General pfSense Questions
    17 Posts 6 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      n3by
      last edited by

      have a look at:  System/Advanced/Notifications/E-mail and see what you can do there with settings, if your email server is located in LAN you can point directly to his internal IP and set the server to accept emails from pfsense internal IP.

      p.s.
      I am using manual installed & configured postfix in "two production" pfsense 2.3.x both connected by OVPN Site to Site and both use local postfix to forward local notification email to email server in LAN without any problems for months ( one of them also use postfix as a backup email for mx domain server so it accept external emails also ).

      1 Reply Last reply Reply Quote 0
      • chamilton_ccnC
        chamilton_ccn
        last edited by

        I realize this is an old thread, but I'm replying since it's one of the first results that appears when Googling this question. Here's all you should need.

        Let's assume you have the following configuration:

        • LAN: 10.0.10.0/24
        • WAN: <whatever>
        • IPSec: 172.16.30.0/24
        • Mail Server: 172.16.30.25

        Assuming your tunnel is functional and no firewall rules are explicitly blocking traffic between the LAN and IPSec, do the following:

        • Create a Gateway (System/Routing/Gateways)
          • Interface: LAN
          • Address Family: IPv4 (obviously, change this to IPv6 if you're doing this for an IPv6 network)
          • Name: LAN_GW
          • Gateway: 10.0.10.1 (... assuming this is the IP address of the LAN interface)
          • Description: LAN Gateway
        • Create a Static Route (System/Routing/Static Routes)
          • Destination Network: 172.16.30.25 (IP address of mail server)
          • Gateway: Select the previously created gateway from the dropdown list (LAN_GW - 10.0.10.1)
          • Description: Route to mail server via IPSec

        Proceed with configuring your notifications, using your internal mail server's IP address.

        F 1 Reply Last reply Reply Quote 1
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Yup.

          https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/accessing-firewall-services-over-ipsec-vpns.html

          Steve

          F 1 Reply Last reply Reply Quote 1
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            Or use VTI IPsec and a regular route. Easy peasy.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 2
            • F
              Fabio Giacobbe @chamilton_ccn
              last edited by

              @chamilton_ccn

              Hi,

              I have the same problem, I tried your solution but it doesn't work.

              has anyone solved the problem?

              Thanks

              fabio

              chamilton_ccnC 1 Reply Last reply Reply Quote 0
              • F
                Fabio Giacobbe @stephenw10
                last edited by

                @stephenw10

                these are our GW

                f68b41cb-2f88-4a56-8dfc-4e405c65e139-image.png

                SMTP is 172.16.43.254

                this is the static route

                10ea0a64-6872-4523-8307-05bdab5bb90a-image.png

                disabled because is not working.

                fabio

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  That route should be a subnet not an address. Use /32 there if you want a single IP.

                  Can we see the IPSec Phase 2 config? Is it actually carrying that?

                  Steve

                  1 Reply Last reply Reply Quote 1
                  • F
                    Fabio Giacobbe
                    last edited by

                    Hi Steve,

                    thanks a lot for your help.

                    I try to explain better:

                    The problem is on our PFsense Firewall installed on our China Plant; We don’t have a ipsec VPN tunnel, but we have a dedicated line for our Italy plant.

                    So the PFsense has a default gateway for the local traffic, and an Interface for the traffic to the IT LAN with a static route.

                    This is the logical schema:

                    b0763419-dc90-4b33-abfc-9f441140b668-image.png

                    These are the interfaces:

                    9729365a-4407-4a71-a1ef-237dca4ae535-image.png

                    gatewas

                    bc40af59-09e7-4a17-9299-b08a1ccc9278-image.png

                    static route to IT LAN

                    a3dcfdfd-3ddc-4326-be8c-36f5e033f384-image.png

                    everything is working well, but the SMTP notification NOT.

                    We have a SMTP gateway server on the IT LAN and we have to use it.

                    SMTP server: 172.16.43.254

                    If I try to ping from firewall it fails:

                    3237849d-9c1b-48f2-97b7-79827e70745f-image.png

                    but if I choose the interface the ping is OK:

                    b4944f15-e6d2-4e97-b752-8acf626e9bc1-image.png

                    the solution should be can choose from which interface to start the SMTP connection, but I don't know if it is possible.

                    If I activated the gateway as suggested:

                    c0ac702b-bbb5-4a33-a868-514e27062eb1-image.png

                    it don't works, this is the ping response:

                    3783b643-5d3e-409b-b34d-4e0bbaae17d8-image.png

                    also don't work ping from other hosts from LAN, but first yes.

                    thanks againg for your support.

                    fabio

                    1 Reply Last reply Reply Quote 1
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Ok, then you don't need the LAN gateway or the statis route. That only applies to policy based IPSec connections. Remove them.

                      With a direct routed connection as you have both smtp and ping traffic should use the system routing table to decide which gateway to use. The route you have to 172.16.40.0/22 should be sufficient, if it is in there correctly. Can we see the routing table from pfSense?

                      Steve

                      F 2 Replies Last reply Reply Quote 1
                      • F
                        Fabio Giacobbe @stephenw10
                        last edited by

                        @stephenw10 said in SMTP notification uses default gateway instead of IPSEC:

                        ufficient, if it is in there correctly. Can we see the routing table from

                        a9c9d6b7-b388-43a8-8bd1-a3e5d05bb603-image.png

                        fabio

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Ok, that should work.

                          Maybe you have something that was already trying to connect and opened a state via the default gateway and it's still open.
                          Check the state table for any states to 172.16.43.254. Delete any ICMP or SMTP that are present.

                          Steve

                          1 Reply Last reply Reply Quote 1
                          • F
                            Fabio Giacobbe @stephenw10
                            last edited by

                            @stephenw10

                            Hi Steve,

                            I understood: it was a NAT problem!

                            For BT interface the NAT from China LAN is disabled, but other network are not trasported to Italy!

                            Now I have defined this new NAT rule:

                            9d959c64-006a-4fe6-b9df-0441cc8e96d9-image.png

                            details:

                            860b8987-a223-4177-86d1-7f6385bb2f86-image.png

                            now the ping is working:

                            1f6c0883-5d74-4aca-8131-f7534029b659-image.png

                            and also the SMTP test is OK:

                            a3c2efa9-f2f6-4bd0-99ea-870dee6b57f3-image.png

                            many thanks for your time and help!

                            I'm sorry I didn't understand earlier that the problem was somewhere else and it was a NAT problem.

                            bye

                            fabio

                            1 Reply Last reply Reply Quote 2
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Ah, cool. 👍

                              1 Reply Last reply Reply Quote 1
                              • chamilton_ccnC
                                chamilton_ccn @Fabio Giacobbe
                                last edited by

                                @Fabio-Giacobbe The scenario I posted was specific to IPSec. But don't feel bad, we've all been in similar NAT-induced (read: confusing) situations. Glad you got it figured out!

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.