How are you supposed to set up Email notifications?

dhpo5683

Under System > Advanced > Notifications

I'm attempting to set up Email notifications so I can receive a confirmation email to set up an ACME certificate. I have been trying for a whole day, and I'm becoming incredibly frustrated, since literally nothing I have done has worked.

First, I set up SMTP via ProtonMail. I already have a domain, and on Proton's end everything is set up correctly. The credentials I have are all valid. I have used the port they recommend: 587 and an alternative 465 when that didn't work. I keep getting the error Error: Failed to connect to ssl://smtp.protonmail.ch:567 [SMTP: Failed to connect socket: Operation timed out (code: -1, response: )] whenever I check the Secure SMTP Connection and/or Validate SSL/TLS boxes.

I also attempted this with Google's SMTP. Once again, these credentials are all valid, but I still can't find any success. With this, I continue getting this error: SMTP: Invalid response code received from server (code: 530, response: 5.7.0 Authentication Required. For more information, go to 5.7.0. It than provides a URL that is invalid.

I know pfsense also offers Telegram, Pushover, and Slack as alternatives, but ACME specifically asks for an email address. Including a regular email doesn't work, and I'm unable to receive any emails. I've been trying to set up SSL certificates for my homelab. I know there are alternatives like NGINX, SWAG, and Traefik. I haven't been able to get NGINX to work for whatever reason, unless I'm using self-signed certificates, but the self-signed certificates errors drive me crazy. I don't know enough about SWAG, and don't have the competence to use traefik.

If anyone can shed any light on this, especially if you have used ACME, I am all ears. If you have additional questions please let me know. Thank you,

SteveITS

@dhpo5683 IIRC Google does [not] allow SMTP anymore? Could be wrong though.

For the other uncheck the “secure” box and it should still use STARTTLS after making the connection.

stephenw10

Works fine for me using Google SMTP. You do have to use the single device login token thing, or whatever Google are calling it these days.

Edit: *App Password

SteveITS

@stephenw10 my bad then, I lose track. M365 is killing off options one by one.

dhpo5683

@SteveITS I get the same error message even after unchecking it.

@stephenw10 That's the weird thing, I am using the dedicated login info for both Proton and Gmail. Do I need to open ports to make it seem like a legitimate mail server?

stephenw10

Nope you shouldn't need to open anything. It's an outbound connection that would be allowed by default. Unless you have added outbound block rules?

dhpo5683

@stephenw10 I haven't. This is a fresh installation. I also think Proton made it so you don't need to use their bridge to use SMTP. I'm honestly at a loss.

stephenw10

Run a pcap on WAN for the remote port. Make sure it is at least trying to connect out and sees some sort of reply.

Gertjan

@dhpo5683 said in How are you supposed to set up Email notifications?:

Do I need to open ports to make it seem like a legitimate mail server?

Google not working ?

works fine.

There is one important hidden thing not shown here :
This one :

Repeat after me : this should never ever be your gmail password, the one you use as a person.
(pfSense isn't a person, its a "machine" )

So, a couple of years ago, app password were invented.
In your Google account, create an "app password". You can give it it name like 'MyFsense".
Google will give you a password like "fhfgfgf dsdfsdf dfsfsf sdfsfsf". Copy paste this twice here :

Done.
Well .... Nearly.
When I access my Google account, I can't find these app passwords anymore.

Do this :

Type "app passwords" and you'll find them :

That's the place where you can add your pfSense 'machine' password.
I've 3 of them, as you can see.

This became 'mandatory' years ago ... here in France (that Europe).
Maybe elsewhere security is

Btw : why all this ? Easy ? Go visit a land fill, and you find old printers computers access points, NAS, doorbells, lightbulbs ... whatever. JTAG them, get the info out and you'll get some one password ^^
With this app password system, you visit your app password list and ditch the old ones, the ones you don't need anymore without going over the process of changing your real 'human 'password.

Also : pfSense itself is behind the WAN interface, so floating firewall rules aside (by default none) it can go everywhere it wants. So it can go out, find the A or AAAA of gmail (Google) and send a mail.
Yo don't use the 25 port, as that port is reserved for other mail servers only. Not mail clients, such as pfSense in this case. pfSense isn't a mail server (our ISPs, in the end of last century really f*ck#d up telling people to use '25' as a mail server).
Btw : I use '465' as that still works. Better is probably the good old submission port = 587.

dhpo5683

@Gertjan lol. Apparently the issue was I didn't have the "from e-mail address" field filled out correctly. Thank you for this.

Gertjan

@dhpo5683
Ah, ok, lol.
You could even use your own gmail mail here.