Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Mail servers imap behind pfsense not reachable

    Scheduled Pinned Locked Moved Firewalling
    62 Posts 8 Posters 9.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      Well something is answering on his IP he is connecting to the forum with, which I would assume his IP... But from his packet capture - nothing is getting to pfsense..

      Pfsense can not forward what it does not see.. This is basic 101 stuff here..

      edit: I do not know what to tell you.. This is basic 101 stuff here, if you can not show us pfsense seeing the traffic on its wan... How could it ever do anything with it.. All I can tell you is something answers on 143 when I hit the IP you connected to the forum from..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • V
        viragomann @daan
        last edited by

        @daan said in Mail servers imap behind pfsense not reachable:

        When I do not specify a port I see loads of traffic, HTTPS traffic

        You can also limit the capture to multiple port by entering "143|587|993" for instance to take all IMAP ports.

        1 Reply Last reply Reply Quote 0
        • V
          viragomann @daan
          last edited by

          @daan
          You can check your real public IP on web services like https://whatismyipaddress.com

          The IP you get displayed there must match your pfSense WAN IP, otherwise there is a router in front of pfSense.

          1 Reply Last reply Reply Quote 0
          • D
            daan
            last edited by

            @viragomann I know my it is the same IP as the pfsense WAN interface IP

            1 Reply Last reply Reply Quote 0
            • D
              daan
              last edited by

              @johnpoz this is my capture with 143|465|587|993 as ports
              Screenshot 2020-09-25 1449523.png

              V P 2 Replies Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Do a simple sniff on 143 then..

                Then go to can you see me . org and put in 143..

                You should see this traffic. Clearly sniffing is working.. But I don't see any traffic for 143.

                To be honest, sure looks to be working to me.. Whatever issues you might be having with imap has nothing to do with pfsense. I get a connection to 143, and sure seems to be whatever server your running behind pfsense.. reports Dovecot (Debian), which is what your Poste.io server uses for imap..

                btw I see 993 there in your sniff which would be imap over tls. Maybe your client is just not using 143 when you tested which is why you didn't see on sniff.. Do can you see me . org so you know exactly what port is being sent.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                D 1 Reply Last reply Reply Quote 0
                • V
                  viragomann @daan
                  last edited by viragomann

                  @daan said in Mail servers imap behind pfsense not reachable:

                  this is my capture with 143|465|587|993 as ports

                  Ther is obviously a communiction on 993. Possibly your client switches automatically to 993 (SSL)?

                  However, the traffic may be outbound as well. You're the only one who knows the destination IP, we cannot see it.

                  GertjanG D 2 Replies Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @viragomann
                    last edited by

                    @viragomann said in Mail servers imap behind pfsense not reachable:

                    Ther is obviously a communiction on 993. Possibly your client switches automatically to 993 (SSL)?

                    Hummm : 993 was already mentioned above.
                    Check if the mail server "IMAPS" is listening on port 993 on the IMAP server before you NAT that port (TCP).

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      daan @johnpoz
                      last edited by daan

                      @johnpoz These are my client settings, the settings worked fine with my previous router.
                      Screenshot 2020-09-25 151153.png

                      And yes I am using poste.io

                      1 Reply Last reply Reply Quote 0
                      • D
                        daan @viragomann
                        last edited by

                        @viragomann My public IP reports in inbound as well as outbound traffic on port 993

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Well your client not set to use 143 in that setup. So why would you think you would see traffic on 143?

                          Not sure what to tell you... Pfsense only job in this is sending the traffic on to where you tell it to send it. Clearly from your sniff that is happening on 993.. So whatever issues you have with imap has nothing to do with pfsense.. Its a dumb doorman in the big picture.. It sees traffic on port X, and sends it on to where you told it to send it.. And then sends the answer back - it has nothing to do with the workings of the conversation.. Nor does it care..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          D 1 Reply Last reply Reply Quote 0
                          • D
                            daan @Gertjan
                            last edited by

                            @Gertjan Yes I did I uploaded a screenshot of it
                            alt text

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan
                              last edited by

                              1e7b2090-74e1-4446-8e3b-ca3df2f86c2b-image.png

                              STARTTLS seems strange when using 993 as there can't be a TLS negotiation - it will be a direct SSL/TLS connection, like your 465 = SMTPS outgoing mail connection.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              D 1 Reply Last reply Reply Quote 0
                              • D
                                daan @johnpoz
                                last edited by

                                @johnpoz Same story when I use port 143, it does not connect.
                                Yes I know what pfsense does, but why did it work fine on my previous router and not on my pfsense router?

                                1 Reply Last reply Reply Quote 0
                                • D
                                  daan @Gertjan
                                  last edited by

                                  @Gertjan My mail server does TLS over port 993
                                  df9c81dd-cd73-48c9-928b-5ae0cd9c6053-image.png
                                  (POP, HTTP and HTTPS are not forwarded)

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    @daan said in Mail servers imap behind pfsense not reachable:

                                    Same story when I use port 143, it does not connect.

                                    It does connect.. I have connected via 143..

                                    connect.png

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    D 1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann
                                      last edited by

                                      Since we cannot see any unencryted connection attempts, I think it's a legitimate question, if there is a valid SSL certificate installed on the IMAP server.

                                      D 1 Reply Last reply Reply Quote 0
                                      • D
                                        daan @johnpoz
                                        last edited by

                                        @johnpoz Wattt the hell, when I do the same it returns
                                        29d7ebdc-0255-441d-a993-44ac60e67925-image.png

                                        bmeeksB 1 Reply Last reply Reply Quote 0
                                        • D
                                          daan @viragomann
                                          last edited by

                                          @viragomann Yes there is, I am using Let's encrypt mail certificates.

                                          V 1 Reply Last reply Reply Quote 0
                                          • V
                                            viragomann @daan
                                            last edited by

                                            @daan
                                            Let's Encrypt is no surety for validation. Possibly the update job failed.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.