No out going mail using PIA VPN with don't pull routes turned off
-
Hello,
I recently discovered my WAN IP address is exposed when using PIA VPN with don't bull routes turned on. This setup however allows me to send out mail using my own mail server on a DMZ interface. If I turn off don't pull routes my WAN IP address is not exposed but I'm unable to send out mail.
I contacted PIA to white list my mail server put it still doesn't work. They told me in order for it to work I would need to my mail server in front of the pfSense box.
Is there a way I can send out mail with don't pull routes off by other means? Id so could someone give me some guidance. Your help would be much appreciated.
Karl
-
Check "Don't pull routes" and add a firewall rule to your LAN interface or whichever the mail server is connected to with
Source = your mail server
Source port = any
Destination = any
Dest. port = 25
Gateway = WAN GWYou find the gateway setting if you display the advanced options.
Put this rule on the top of your rule set.Edit the other rule which permits the remaining traffic (by default there is an allow any-to-any rule at LAN interface for IPv4 and another one for IPv6) and set the gateway to PIA.
Then mails should go out to WAN GW and the whole remaining traffic go out to your PIA GW.
-
What you suggested is what I presently have setup. With Don't Pull Routes checked I'm able to send out mail but my wan IP address is exposed, unchecked I'm unable to send out mail but my IP is not leaked.
-
Get it configured so it is NOT working with Don't Pull Routes checked and post your LAN rules and any pertinent aliases.
Are you trying to send mail from the firewall itself or from a host on LAN?
-
Are you trying to send mail from the firewall itself or from a host on LAN?
I'm sending mail from my mail client on the WLAN network. The mail server resides on my DMZ network.
My current rules are set as the attached file.
-
What interface are those rules from?? Seems odd that if that is your dmz interface that you would have a rule that says wlan to dmz on it - since that doesn't do anything on that interface.. Why do you have sources of wlan net on your dmz interface.
As to your wan IP being exposed, you mean your mail is being sent directly out your wan and not your vpn I take it… We need to see the rules on the interface your mailserver sends traffic too. If its in dmz, then the dmz interface.
If that is indeed your dmz interface then your 2nd rule allows dest of mail server private whatever is in there on port 25 so yeah that would go out your normal wan. Not sure why it says nat on it for a description?
Rules are evaluated top down from the interface the traffic hits, first rule wins.
-
What interface are those rules from
There from my Wireless network
your mail is being sent directly out your wan and not your vpn I take it.
Yes
Not sure why it says NAT on it for a description
I created a port forward rule from WLAN to DMZ in order to send mail out through my mail client on my desktop computer in the WLAN network
DMZ Network Rules where my mail server resides
Mail Server Private
-
so your server in your dmz segment, your dmz rules do not allow any email sort of traffic, ie there is no rule there that would allow smtp (tcp 25). Your rule on your dmz segment that would allow traffic is greyed out. that any any rule.
Why are you portforwarding and then natting form wlan segment to your dmz segment?? That makes ZERO sense to me…
If you want your email server to use your PIA vpn connection on your dmz interface that sends your mail traffic through the vpn, which I do not see.
Why don't you explain what you want to happen, and then we can go over the rules that should be setup to allow that. Who do you want your clients in wlan to talk to for mail? Your box in the dmz? Why would think that is a port forward?
-
so your server in your dmz segment, your dmz rules do not allow any email sort of traffic, ie there is no rule there that would allow smtp (tcp 25). Your rule on your dmz segment that would allow traffic is greyed out. that any any rule.
I was always able to receive mail and send out mail without a rule setup on my DMZ interface before configuring PIA and up to now I could send mail out and receive mail. May be my setup is not ideal but it works based on tutorials I found when initially setting up pfSense. I'm using Virtual IPs, 1:1 mappings, and port forwarding to route mail inbound and outbound since I have a block of public IPs /29 to private IPs.
Why are you portforwarding and then natting form wlan segment to your dmz segment?? That makes ZERO sense to me…
I believe the rule on my WLAN was auto generated when I created the port forwarding rule. If I disable the WLAN rule my mail client is unable to connect to the mail server to send out mail
If you want your email server to use your PIA vpn connection on your dmz interface that sends your mail traffic through the vpn, which I do not see.
All I want is to be able to send out mail using what ever means without having my WAN IP exposed but having the PIA IP address instead. My initial thread has two attachments showing what I mean.
Below you will find attachments showing my portfowarding, mappings and virtual IPsRegards,
-
I would like to have closure on my thread so could anyone let me know if what I'm trying to achieve is possible by sending mail outbound with my own mail server and "Don't pull routes" turned off so my IP address is hidden from my internet provider.
Regards,
-
I would be very surprised if PIA did not block outbound TCP/25 (SMTP).
-
I would be very surprised if PIA did not block outbound TCP/25 (SMTP).
They do block outbound SMTP. I had them whitelist my hostname and IP address.
-
You need a policy routing rule on DMZ. TCP source mail_server_addr port any Dest any port 25 with the gateway set to the VPN gateway. Just like in viragomann's first reply but setting the VPN as the gateway.
ssh to the mail server and:
telnet smtp.gmail.com 25
What happens?
Also put a policy routing rule exactly the same, except port 80, then from the mail server:
curl ifconfig.io
Do you get your WAN IP or the VPN IP?
If not the VPN post your DMZ rules.
-
I'm not sure how to connect using ssh with putty to my mail server nor the curl ifconfig.io command. After setting a rule for smtp on the DMZ interface I used a utility on hmailserver and ran the diagnostic which resulted in not able to connect to a host. I have attached a file showing this and the rule I setup.
Regards,
-
Looks to me like PIA is really not allowing you to connect out port 25. You will have to run a packet capture on the PIA interface and run your test again. You will probably see TCP SYN packets outbound to PIA and nothing in reply.
-
I ran the capture packet from pfSense and as you said it looks like packets went outbound but nothing in reply. This of coarse was with "Don't Pull Routes" turned off.
I also tried with "Don't Pull Routes" turned on and of coarse the results were different.
Is this issue resolve able? or do I have to live with the fact that if I use "Don't Pull routes" turned on I will be able to send out mail but my WAN IP will be displayed.
-
That makes zero sense at all. The packet is either routed out the correct interface or it is not. Whether it is a 0.0.0.0/0 route or a policy route just does not matter and has zero impact on whether replies are received. You are looking at something incorrectly.
-
Im with derelict here I doubt pia allows sending email on 25.. And lets say they did - how would that work since your PTR is not going to match..
Are you trying to send spam? Sending email needs to come from your valid IP that matches both forward and ptr or many players will just block you anyway. I doubt anyone would accept email from a vpn ip anyway..
-
Thanks fellows for your help up to now, but I need to know if it's possible to achieve my goal. I'm far from being an expert on configuring firewalls or networking. If it's possible then let m know what I need to do. I was told in the past that it was possible.
-
yes it possible to route whatever traffic you want over a vpn connection. But here is the thing that vpn connect needs to allow the traffic you want to send. I would not be surprised if PIA prevents 25 traffic. They are in the business of hiding peoples connections from their isp, being used for geographic circumvention, etc.
Who would route email out through that connection?? Even if they allow it most of the major players would block that.. Simple enough to test, route your traffic over your vpn and see if you can make a connection to some smtp server.
Lets say they do allow it, and where your sending the email doesn't block the vpn IP from sending mail to it. What is your information on your email server. So lets say its mail.domain.tld that resolves to what IP? lets say 1.2.3.4, it sure doesn't resolve to the vpn IP does it lets say 5.6.7.8
Lets say you do all of this, lets say your forward name resolves to the vpn IP, and email comes through there at 5.6.7.8 down the tunnel to your email server. Does the vpn company allow you to modify the ptr on this 5.6.7.8 to say mail.domain.tld - I highly doubt that!! For starters those IPs are shared with all their other customers trying to circumvent geo locations and get netflix from the US for example..
Email really needs to be sent from YOUR actual IP, this IP should be static so not some home isp connection. And you also need to setup the PTR so whatever that IP is resolves to what your mail server says its name is, etc..
You really need to read the RFCs on running a mail server…
-
I was able to finally resolve my issue. After trying to use telnet, ping and tracert commands with no success I finally figured out that I was missing the outbound PIAVPN interface NAT rule for my DMZ source IP range. Even though this did not help to send out mail outbound from my mail server, I was able to use the commands to figure out what worked. Finally I used the mail forwarder in hmailserver to a out.myprovider.com 1025 server from my ISP. Now I happy to say I can send out mail with "don't pull routes" deselected.
