Outbound NAT for SMTP

[Groen]

I have 2x WAN and 1x LAN

I'm having trouble forcing the mail out via WAN1.

1.  WAN1 172.16.1.2  Upstream Gateway 172.16.1.1.  The mail should go out here.
2.  WAN2 172.16.2.2  Upstream Gateway 172.16.2.1.  This is Default Gateway.
3.  LAN  192.168.0.0 / 24

Exchange Mail Server at 192.168.0.3.  Incoming mail from WAN1 is working.

This is the Outbound NAT Mapping.  It does not work
Interface  Source       Source Port Destination Destination Port     NAT Address     NAT Port Static Port   Description
WAN1   192.168.0.3/32  tcp/*     *             tcp/25             172.16.1.1/32                25 No   Mail Out
I have this right at the top.

When I disable WAN2 the mail goes out without a problem.

[muswellhillbilly]

Looks ok, except that the NAT Address should be the IP address of the WAN1 interface (172.16.1.2). If that change doesn't work, post your firewall rules.

[shadowconnect]

@Groen:

This is the Outbound NAT Mapping.  It does not work
Interface  Source       Source Port Destination Destination Port     NAT Address     NAT Port Static Port   Description
WAN1   192.168.0.3/32  tcp/*     *             tcp/25             172.16.1.1/32                25 No   Mail Out
I have this right at the top.

I think you must change the gateway and not NAT, so you have to remove the NAT rule and add a rule under Firewall->Rules->LAN

 	States	Protocol 	Source 		Port 	Destination 	Port	Gateway 	Queue 	Schedule 	Description 	Actions
	...	IPv4*		192.168.0.3/32	*	*		tcp/25	172.16.1.1	none			Mail Out 

[muswellhillbilly]

Out of the box, you wouldn't need outbound NAT for SMTP, given the default rule from LAN to WAN is 'permit' anyway. The assumption I'm making here is that you have removed the default rule and are selectively adding rules. The firewall rule given in shadowconnect's post is correct, but the NAT rule should still have the WAN1 interface address (172.16.1.2) as the 'NAT Address' entry. From the firewall's perspective, you're NATing through the external firewall address, not the next hop.

[Groen]

Thanks for the replies.

I'm busy testing.

[Groen]

We had a 50/50 success/fail rate without the NAT/Rule.  The load balancer used to sent mail out randomly on WAN1 and WAN2.

---

If I see the values incrementing  under "states" in the new rule, after I have send out a test email, does it work then?  (evaluations, packets, bytes).

I have now sent 10 emails with success.

[johnpoz]

you really shouldn't have to change anything in the outbound nat.. All you should have to do is create a policy that routes the traffic out the gateway you want to use.

[Groen]

@ shadowconnect .  It looks like that solved the proiblem.

I will report back in a day.

[Groen]

SOLVED.  Thanks.