Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No out going mail using PIA VPN with don't pull routes turned off

    Scheduled Pinned Locked Moved OpenVPN
    21 Posts 4 Posters 4.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kiekar
      last edited by

      Hello,

      I recently discovered my WAN IP address is exposed when using PIA VPN with don't bull routes turned on. This setup however allows me to send out mail using my own mail server on a DMZ interface.  If I turn off don't pull routes my WAN IP address is not exposed but I'm unable to send out mail.

      I contacted PIA to white list my mail server put it still doesn't work. They told me in order for it to work I would need to my mail server in front of the pfSense box.

      Is there a way I can send out mail with don't pull routes off by other means? Id so could someone give me some guidance. Your help would be much appreciated.

      Karl
      dont_pull_routes_selected.jpg
      dont_pull_routes_selected.jpg_thumb
      dont_pull_routes_deselected.jpg
      dont_pull_routes_deselected.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • V
        viragomann
        last edited by

        Check "Don't pull routes" and add a firewall rule to your LAN interface or whichever the mail server is connected to with
        Source = your mail server
        Source port = any
        Destination = any
        Dest. port = 25
        Gateway = WAN GW

        You find the gateway setting if you display the advanced options.
        Put this rule on the top of your rule set.

        Edit the other rule which permits the remaining traffic (by default there is an allow any-to-any rule at LAN interface for IPv4 and another one for IPv6) and set the gateway to PIA.

        Then mails should go out to WAN GW and the whole remaining traffic go out to your PIA GW.

        1 Reply Last reply Reply Quote 0
        • K
          kiekar
          last edited by

          What you suggested is what I presently have setup. With Don't Pull Routes checked I'm able to send out mail but my wan IP address is exposed, unchecked I'm unable to send out mail but my IP is not leaked.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Get it configured so it is NOT working with Don't Pull Routes checked and post your LAN rules and any pertinent aliases.

            Are you trying to send mail from the firewall itself or from a host on LAN?

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • K
              kiekar
              last edited by

              Are you trying to send mail from the firewall itself or from a host on LAN?

              I'm sending mail from my mail client on the WLAN network. The mail server resides on my DMZ network.

              My current rules are set as the attached file.

              WLAN_RULES.jpg
              WLAN_RULES.jpg_thumb

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                What interface are those rules from??  Seems odd that if that is your dmz interface that you would have a rule that says wlan to dmz on it - since that doesn't do anything on that interface..  Why do you have sources of wlan net on your dmz interface.

                As to your wan IP being exposed, you mean your mail is being sent directly out your wan and not your vpn I take it…  We need to see the rules on the interface your mailserver sends traffic too.  If its in dmz, then the dmz interface.

                If that is indeed your dmz interface then your 2nd rule allows dest of mail server private whatever is in there on port 25 so yeah that would go out your normal wan.  Not sure why it says nat on it for a description?

                Rules are evaluated top down from the interface the traffic hits, first rule wins.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • K
                  kiekar
                  last edited by

                  What interface are those rules from

                  There from my Wireless network

                  your mail is being sent directly out your wan and not your vpn I take it.

                  Yes

                  Not sure why it says NAT on it for a description

                  I created a port forward rule from WLAN to DMZ in order to send mail out through my mail client on my desktop computer in the WLAN network

                  DMZ Network Rules where my mail server resides

                  Mail Server Private

                  DMZ_Network_Rules.jpg
                  DMZ_Network_Rules.jpg_thumb
                  Mail_Server_Private_IP.jpg
                  Mail_Server_Private_IP.jpg_thumb

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    so your server in your dmz segment, your dmz rules do not allow any email sort of traffic, ie there is no rule there that would allow smtp (tcp 25).  Your rule on your dmz segment that would allow traffic is greyed out. that any any rule.

                    Why are you portforwarding and then natting form wlan segment to your dmz segment?? That makes ZERO sense to me…

                    If you want your email server to use your PIA vpn connection on your dmz interface that sends your mail traffic through the vpn, which I do not see.

                    Why don't you explain what you want to happen, and then we can go over the rules that should be setup to allow that.  Who do you want your clients in wlan to talk to for mail?  Your box in the dmz?  Why would think that is a port forward?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • K
                      kiekar
                      last edited by

                      so your server in your dmz segment, your dmz rules do not allow any email sort of traffic, ie there is no rule there that would allow smtp (tcp 25).  Your rule on your dmz segment that would allow traffic is greyed out. that any any rule.

                      I was always able to receive mail and send out mail without a rule setup on my DMZ interface before configuring PIA and up to now I could send mail out and receive mail. May be my setup is not ideal but it works based on tutorials I found when initially setting up pfSense. I'm using Virtual IPs, 1:1 mappings, and port forwarding to route mail inbound and outbound since I have a block of public IPs /29 to private IPs.

                      Why are you portforwarding and then natting form wlan segment to your dmz segment?? That makes ZERO sense to me…

                      I believe the rule on my WLAN was auto generated when I created the port forwarding rule. If I disable the WLAN rule my mail client is unable to connect to the mail server to send out mail

                      If you want your email server to use your PIA vpn connection on your dmz interface that sends your mail traffic through the vpn, which I do not see.

                      All I want is to be able to send out mail using what ever means without having my WAN IP exposed but having the PIA IP address instead. My initial thread has two attachments showing what I mean.
                      Below you will find attachments showing my portfowarding, mappings and virtual IPs

                      Regards,

                      Virtual_IP.jpg
                      Virtual_IP.jpg_thumb
                      1-1_mappings.jpg
                      1-1_mappings.jpg_thumb
                      Port_forwarding.jpg
                      Port_forwarding.jpg_thumb

                      1 Reply Last reply Reply Quote 0
                      • K
                        kiekar
                        last edited by

                        I would like to have closure on my thread so could anyone let me know if what I'm trying to achieve is possible by sending mail outbound with my own mail server and "Don't pull routes" turned off so my  IP address is hidden from my internet provider.

                        Regards,

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          I would be very surprised if PIA did not block outbound TCP/25 (SMTP).

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • K
                            kiekar
                            last edited by

                            I would be very surprised if PIA did not block outbound TCP/25 (SMTP).

                            They do block outbound SMTP. I had them whitelist my hostname and IP address.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              You need a policy routing rule on DMZ. TCP source mail_server_addr port any Dest any port 25 with the gateway set to the VPN gateway. Just like in viragomann's first reply but setting the VPN as the gateway.

                              ssh to the mail server and:

                              telnet smtp.gmail.com 25

                              What happens?

                              Also put a policy routing rule exactly the same, except port 80, then from the mail server:

                              curl ifconfig.io

                              Do you get your WAN IP or the VPN IP?

                              If not the VPN post your DMZ rules.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • K
                                kiekar
                                last edited by

                                I'm not sure how to connect using ssh with putty to my mail server nor the curl ifconfig.io command. After setting a rule for smtp on the DMZ interface I used a utility on hmailserver and ran the diagnostic which resulted in not able to connect to a host. I have attached a file showing this and the rule I setup.

                                Regards,

                                hmailserver_diagnostic.jpg
                                hmailserver_diagnostic.jpg_thumb
                                dmz_rules.jpg
                                dmz_rules.jpg_thumb

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Looks to me like PIA is really not allowing you to connect out port 25. You will have to run a packet capture on the PIA interface and run your test again. You will probably see TCP SYN packets outbound to PIA and nothing in reply.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    kiekar
                                    last edited by

                                    I ran the capture packet from pfSense and as you said it looks like packets went outbound but nothing in reply. This of coarse was with "Don't Pull Routes" turned off.
                                    I also tried with "Don't Pull Routes" turned on and of coarse the results were different.
                                    Is this issue resolve able? or do I have to live with the fact that  if I use "Don't Pull routes" turned on I will be able to send out mail but my WAN IP will be displayed.

                                    packet_capture.jpg
                                    packet_capture.jpg_thumb
                                    packet_capture_dont_pull_roots_on.jpg
                                    packet_capture_dont_pull_roots_on.jpg_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      That makes zero sense at all. The packet is either routed out the correct interface or it is not. Whether it is a 0.0.0.0/0 route or a policy route just does not matter and has zero impact on whether replies are received. You are looking at something incorrectly.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        Im with derelict here I doubt pia allows sending email on 25..  And lets say they did - how would that work since your PTR is not going to match..

                                        Are you trying to send spam?  Sending email needs to come from your valid IP that matches both forward and ptr or many players will just block you anyway.  I doubt anyone would accept email from a vpn ip anyway..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kiekar
                                          last edited by

                                          Thanks fellows for your help up to now, but I need to know if it's possible to achieve my goal. I'm far from being an expert on configuring firewalls or networking. If it's possible then let m know what I need to do. I was told in the past that it was possible.

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            yes it possible to route whatever traffic you want over a vpn connection.  But here is the thing that vpn connect needs to allow the traffic you want to send.  I would not be surprised if PIA prevents 25 traffic.  They are in the business of hiding peoples connections from their isp, being used for geographic circumvention, etc.

                                            Who would route email out through that connection??  Even if they allow it most of the major players would block that.. Simple enough to test, route your traffic over your vpn and see if you can make a connection to some smtp server.

                                            Lets say they do allow it, and where your sending the email doesn't block the vpn IP from sending mail to it.  What is your information on your email server.  So lets say its mail.domain.tld that resolves to what IP? lets say 1.2.3.4, it sure doesn't resolve to the vpn IP does it lets say 5.6.7.8

                                            Lets say you do all of this, lets say your forward name resolves to the vpn IP, and email comes through there at 5.6.7.8 down the tunnel to your email server.  Does the vpn company allow you to modify the ptr on this 5.6.7.8 to say mail.domain.tld - I highly doubt that!!  For starters those IPs are shared with all their other customers trying to circumvent geo locations and get netflix from the US for example..

                                            Email really needs to be sent from YOUR actual IP, this IP should be static so not some home isp connection.  And you also need to setup the PTR so whatever that IP is resolves to what your mail server says its name is, etc..

                                            You really need to read the RFCs on running a mail server…

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.