No out going mail using PIA VPN with don't pull routes turned off

kiekar

Hello,

I recently discovered my WAN IP address is exposed when using PIA VPN with don't bull routes turned on. This setup however allows me to send out mail using my own mail server on a DMZ interface. If I turn off don't pull routes my WAN IP address is not exposed but I'm unable to send out mail.

I contacted PIA to white list my mail server put it still doesn't work. They told me in order for it to work I would need to my mail server in front of the pfSense box.

Is there a way I can send out mail with don't pull routes off by other means? Id so could someone give me some guidance. Your help would be much appreciated.

Karl

dont_pull_routes_selected.jpg_thumb

dont_pull_routes_deselected.jpg_thumb

viragomann

Check "Don't pull routes" and add a firewall rule to your LAN interface or whichever the mail server is connected to with
Source = your mail server
Source port = any
Destination = any
Dest. port = 25
Gateway = WAN GW

You find the gateway setting if you display the advanced options.
Put this rule on the top of your rule set.

Edit the other rule which permits the remaining traffic (by default there is an allow any-to-any rule at LAN interface for IPv4 and another one for IPv6) and set the gateway to PIA.

Then mails should go out to WAN GW and the whole remaining traffic go out to your PIA GW.

kiekar

What you suggested is what I presently have setup. With Don't Pull Routes checked I'm able to send out mail but my wan IP address is exposed, unchecked I'm unable to send out mail but my IP is not leaked.

Derelict

Get it configured so it is NOT working with Don't Pull Routes checked and post your LAN rules and any pertinent aliases.

Are you trying to send mail from the firewall itself or from a host on LAN?

kiekar

Are you trying to send mail from the firewall itself or from a host on LAN?

I'm sending mail from my mail client on the WLAN network. The mail server resides on my DMZ network.

My current rules are set as the attached file.

WLAN_RULES.jpg_thumb

johnpoz

What interface are those rules from?? Seems odd that if that is your dmz interface that you would have a rule that says wlan to dmz on it - since that doesn't do anything on that interface.. Why do you have sources of wlan net on your dmz interface.

As to your wan IP being exposed, you mean your mail is being sent directly out your wan and not your vpn I take it… We need to see the rules on the interface your mailserver sends traffic too. If its in dmz, then the dmz interface.

If that is indeed your dmz interface then your 2nd rule allows dest of mail server private whatever is in there on port 25 so yeah that would go out your normal wan. Not sure why it says nat on it for a description?

Rules are evaluated top down from the interface the traffic hits, first rule wins.

kiekar

What interface are those rules from

There from my Wireless network

your mail is being sent directly out your wan and not your vpn I take it.

Yes

Not sure why it says NAT on it for a description

I created a port forward rule from WLAN to DMZ in order to send mail out through my mail client on my desktop computer in the WLAN network

DMZ Network Rules where my mail server resides

Mail Server Private

DMZ_Network_Rules.jpg_thumb

Mail_Server_Private_IP.jpg_thumb

johnpoz

so your server in your dmz segment, your dmz rules do not allow any email sort of traffic, ie there is no rule there that would allow smtp (tcp 25). Your rule on your dmz segment that would allow traffic is greyed out. that any any rule.

Why are you portforwarding and then natting form wlan segment to your dmz segment?? That makes ZERO sense to me…

If you want your email server to use your PIA vpn connection on your dmz interface that sends your mail traffic through the vpn, which I do not see.

Why don't you explain what you want to happen, and then we can go over the rules that should be setup to allow that. Who do you want your clients in wlan to talk to for mail? Your box in the dmz? Why would think that is a port forward?

kiekar

so your server in your dmz segment, your dmz rules do not allow any email sort of traffic, ie there is no rule there that would allow smtp (tcp 25). Your rule on your dmz segment that would allow traffic is greyed out. that any any rule.

I was always able to receive mail and send out mail without a rule setup on my DMZ interface before configuring PIA and up to now I could send mail out and receive mail. May be my setup is not ideal but it works based on tutorials I found when initially setting up pfSense. I'm using Virtual IPs, 1:1 mappings, and port forwarding to route mail inbound and outbound since I have a block of public IPs /29 to private IPs.

Why are you portforwarding and then natting form wlan segment to your dmz segment?? That makes ZERO sense to me…

I believe the rule on my WLAN was auto generated when I created the port forwarding rule. If I disable the WLAN rule my mail client is unable to connect to the mail server to send out mail

If you want your email server to use your PIA vpn connection on your dmz interface that sends your mail traffic through the vpn, which I do not see.

All I want is to be able to send out mail using what ever means without having my WAN IP exposed but having the PIA IP address instead. My initial thread has two attachments showing what I mean.
Below you will find attachments showing my portfowarding, mappings and virtual IPs

Regards,

Virtual_IP.jpg_thumb

1-1_mappings.jpg_thumb

Port_forwarding.jpg_thumb

kiekar

I would like to have closure on my thread so could anyone let me know if what I'm trying to achieve is possible by sending mail outbound with my own mail server and "Don't pull routes" turned off so my IP address is hidden from my internet provider.

Regards,

Derelict

I would be very surprised if PIA did not block outbound TCP/25 (SMTP).

kiekar

I would be very surprised if PIA did not block outbound TCP/25 (SMTP).

They do block outbound SMTP. I had them whitelist my hostname and IP address.

Derelict

You need a policy routing rule on DMZ. TCP source mail_server_addr port any Dest any port 25 with the gateway set to the VPN gateway. Just like in viragomann's first reply but setting the VPN as the gateway.

ssh to the mail server and:

telnet smtp.gmail.com 25

What happens?

Also put a policy routing rule exactly the same, except port 80, then from the mail server:

curl ifconfig.io

Do you get your WAN IP or the VPN IP?

If not the VPN post your DMZ rules.

kiekar

I'm not sure how to connect using ssh with putty to my mail server nor the curl ifconfig.io command. After setting a rule for smtp on the DMZ interface I used a utility on hmailserver and ran the diagnostic which resulted in not able to connect to a host. I have attached a file showing this and the rule I setup.

Regards,

hmailserver_diagnostic.jpg_thumb

dmz_rules.jpg_thumb

Derelict

Looks to me like PIA is really not allowing you to connect out port 25. You will have to run a packet capture on the PIA interface and run your test again. You will probably see TCP SYN packets outbound to PIA and nothing in reply.

kiekar

I ran the capture packet from pfSense and as you said it looks like packets went outbound but nothing in reply. This of coarse was with "Don't Pull Routes" turned off.
I also tried with "Don't Pull Routes" turned on and of coarse the results were different.
Is this issue resolve able? or do I have to live with the fact that if I use "Don't Pull routes" turned on I will be able to send out mail but my WAN IP will be displayed.

packet_capture.jpg_thumb

packet_capture_dont_pull_roots_on.jpg_thumb

Derelict

That makes zero sense at all. The packet is either routed out the correct interface or it is not. Whether it is a 0.0.0.0/0 route or a policy route just does not matter and has zero impact on whether replies are received. You are looking at something incorrectly.

johnpoz

Im with derelict here I doubt pia allows sending email on 25.. And lets say they did - how would that work since your PTR is not going to match..

Are you trying to send spam? Sending email needs to come from your valid IP that matches both forward and ptr or many players will just block you anyway. I doubt anyone would accept email from a vpn ip anyway..

kiekar

Thanks fellows for your help up to now, but I need to know if it's possible to achieve my goal. I'm far from being an expert on configuring firewalls or networking. If it's possible then let m know what I need to do. I was told in the past that it was possible.

johnpoz

yes it possible to route whatever traffic you want over a vpn connection. But here is the thing that vpn connect needs to allow the traffic you want to send. I would not be surprised if PIA prevents 25 traffic. They are in the business of hiding peoples connections from their isp, being used for geographic circumvention, etc.

Who would route email out through that connection?? Even if they allow it most of the major players would block that.. Simple enough to test, route your traffic over your vpn and see if you can make a connection to some smtp server.

Lets say they do allow it, and where your sending the email doesn't block the vpn IP from sending mail to it. What is your information on your email server. So lets say its mail.domain.tld that resolves to what IP? lets say 1.2.3.4, it sure doesn't resolve to the vpn IP does it lets say 5.6.7.8

Lets say you do all of this, lets say your forward name resolves to the vpn IP, and email comes through there at 5.6.7.8 down the tunnel to your email server. Does the vpn company allow you to modify the ptr on this 5.6.7.8 to say mail.domain.tld - I highly doubt that!! For starters those IPs are shared with all their other customers trying to circumvent geo locations and get netflix from the US for example..

Email really needs to be sent from YOUR actual IP, this IP should be static so not some home isp connection. And you also need to setup the PTR so whatever that IP is resolves to what your mail server says its name is, etc..

You really need to read the RFCs on running a mail server…