Strange behaviour with smtp

[giulianoz]

Hello, on 1.2.2 I have the folliwing setup
wan interface with ip a.b.c.1
dmz 1 192.168.13.0/24
lan

on the wan I've setup a virtual IP a.b.c.2 and setup the port forwarding  for it on port 25

WAN  TCP  25 (SMTP)  192.168.13.10 (ext.: a.b.c.2) 25 (SMTP)

to 192.168.13.10 (linux antispam). after processing the mail the antispam forwards it to the internal email server

I've added a rule like this

TCP  *  *  192.168.13.10  25 (SMTP)  *

to enable the traffic from the outside to the antispam server.

I can receive emails fine, but from some hosts I get this:

39. 458397 rule 62/0(match): block in on em1: 111.171.65.25.44705 > 192.168.13.10.25: [|tcp]
2. 865872 rule 62/0(match): block in on em1: 111.171.65.25.44705 > 192.168.13.10.25: [|tcp]
6. 018565 rule 62/0(match): block in on em1: 111.171.65.25.44705 > 192.168.13.10.25: [|tcp]
71. 224688 rule 62/0(match): block in on em1: 111.171.65.25.45288 > 192.168.13.10.25: [|tcp]
3. 059049 rule 62/0(match): block in on em1: 111.171.65.25.45288 > 192.168.13.10.25: [|tcp]

I've got only korean an at&t IPs.

Any idea on what's this ?

thanks

giuliano

[wallabybob]

IF the log was from a pfSense system (you don't seem to have said) then I suggest you dump the firewall rules to see what rule 62 is and that might tell you why the traffic was blocked.

I presume em1 is your WAN interface and that you added the SMTP firewall rule to the WAN interface.

[giulianoz]

Hello,
Yes, the system is pfsense 1.2.2
the rule for smtp was added to the wan interface (em1).
pfctl -vvs rules reports this

@62 block drop in log quick on em1 from bogons:50to any label "block bogon networks from wan"                    
 [ Evaluations: 369980    Packets: 557       Bytes: 27864       States: 0     ]                                    
 [ Inserted: uid 0 pid 48699 ]

running /etc/rc.update_bogons.sh seems to solve the issue (outdated bogons definitions)

thanks

giuliano</bogons:50>