Device unable to send out email on port 587

Inovix

Hello. I'm hoping someone may be able to help with this. The first thing to say is I'm very new to pfSense and I've recently 'inherited' this network and firewall from the previous IT admin, so my experience of pfSense is very limited. Much reading of the docs has been done before posting this.

The issue - A new printer/copier/scanner on site that has been configured for scan-to-email. On this printer/scanner, we've configured all of the IPv4 settings, DNS and SMTP server (using port 587) on the new device, including a SMTP username and password. Printing to the device & scanning from it to shared folders on the local network is all good. Scanning to email, however, is not. When testing the SMTP connection from the printers GUI, it reports 'connection failed'.

When I look at the the firewall logs on pfSense for the IP address of the printer (10.0.14.155), it seems to have 'allowed' the traffic - indicated by the green tick. What I do see, though, is that the source port is randomised, which from my reading is a feature of pfSense.

Looking at the SMTP server inbound traffic, there seems to be no sign if the connection attempt from the site, so it seems the connection attempt is not getting past the pfSense firewall.

What I did next - I then went into Firewall/NAT/Outbound and switched the mode from Automatic to Hybrid. I then added a rule in the Mappings section for the network 10.0.0.0/16, source port and destination left blank, destination 'any', destination port set to 587 and then checked the 'static port' option.

This has not resolved the issue and I'm still getting connection error when testing the SMTP from the printer. Looking again at the firewall logs, I see the source port is still randomised. I'm obviously mistaken in thinking my rule in the Outbound NAT would keep the source port as 587?

I'm not sure what to try next.

For further info, the SMTP server we're using is smtp.mandrillapp.com on port 587. This server does not require SSL, so we've ensured that is unchecked in the printer settings.

I've added these SMTP details on a different scanner at a different site (a site not having pfSense) and it works fine, so I have confidence in the SMTP details.

Any help or further pointers would be appreaciated.

Bob.Dig

@Inovix said in Device unable to send out email on port 587:

Any help or further pointers would be appreaciated.

Why are the source and destination the same ip address in your screenshot?
Post a Network Diagram and the interface rules.
Port randomization has most probably nothing to do with your problem.

Inovix

As mentioned, I'm not at all familiar with pfSense and so all of this config is from the previous IT Admin.

These are the interface rules for WAN & LAN (There are no rules under Floating).

WAN

LAN

viragomann

@Inovix
Please recheck the SMTP server setting on the printer.
Is it a public server? If so, I'd expect to see its public IP in the firewall log as destination.

johnpoz

@Inovix said in Device unable to send out email on port 587:

SMTP server we're using is smtp.mandrillapp.com on port 587

Well that shows an IPs of

;; QUESTION SECTION:
;smtp.mandrillapp.com.          IN      A

;; ANSWER SECTION:
smtp.mandrillapp.com.   3600    IN      CNAME   smtp.us-east-1.mandrillapp.com.
smtp.us-east-1.mandrillapp.com. 3600 IN A       54.226.47.131
smtp.us-east-1.mandrillapp.com. 3600 IN A       54.236.7.116
smtp.us-east-1.mandrillapp.com. 3600 IN A       54.209.22.5
smtp.us-east-1.mandrillapp.com. 3600 IN A       18.208.190.224
smtp.us-east-1.mandrillapp.com. 3600 IN A       3.80.109.92
smtp.us-east-1.mandrillapp.com. 3600 IN A       3.91.68.97

How would you get there going to the 10.0.14.155 address? Your saying that is the printers address? Then why would it send that to pfsense if it was trying to go to its own address?

Inovix

Folks - thanks to all for their input.

The fact that the printer was trying to send to itself was causing some confusion.

I configured the smtp in an app on another device on the same network (10.0.1.4.136) and tried sending. That failed as well. Checked the firewall logs .....

.... the destination IP is the original printer we're having issues with!!!

There had to be something on this firewall and sure enough, there was a rule in the Port Forward section to send traffic on 587 to 10.0.14.155

Deleted that rule - tested again and we're all good.

Thanks again for your help.