last day (16 days later) » 

8:51 PM
@CodeMed ping
Your server's network connection is over tun0???
 
hi
smtp is eth0, but openvpn is tun0
 
you need to do the tcpdump in the interface the smtp traffic should come on. And yeah, adding 'tcp port 25' to the line is a good idea
 
firewall-cmd --list-all
public (default, active)
interfaces: enp3s0
sources:
services: dhcpv6-client imaps openvpn smtp
ports:
masquerade: yes
forward-ports:
icmp-blocks:
rich rules:
 
or you could try tcpdump -i any
 
tcpdump -i any runs forever
on the server at least.
 
8:56 PM
yeah, tcpdump runs until you control-c it
tcpdump -i any tcp port 25
and -n if DNS resolution takes too long
 
does the firewall-cmd --list-all output help you identify the syntact i should use?
tcpdump -i any tcp port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
i don't know how to run a command in enp3s0 versus tun0. Unless you mean adding ssh to the public zone and logging in as ssh myaccount@mydomain.com
 
tcpdump takes the interface name as an -i argument
but if you actually tried to connect to the SMTP service when that tcpdump -i any tcp port 25, there should have been packets
Even if the host's firewall dropped them, pretty sure tcpdump should still see them.
 
ok. i will leave it open on both sides then try Thunderbird right now. i am still learning how to do this.
 
or just try nc remote-server-ip 25
much easier (and more reliable, really) than firing up Thunderbird.
 
the client is giving output now as tcpdump -i any tcp port 25 is running both on client and server. But Thunderbird has not timed out yet, so I am waiting to post results for another minute or two.
 
9:04 PM
you should see output on the server one pretty much at the same time as on the client one.
also, confirm on your client one that the packets are being sent to the correct IP address.
16:05:17.252790 IP source-name/ip . source-port > dest-name/ip . dest-port : Flags [.], ack 144, win 1444, options [nop,nop,TS val 1596561858 ecr 2857131190], length 0
 
at the devbox, while thunderbird was trying to send, i got:
tcpdump -i any tcp port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
13:02:51.196113 IP localhost.localdomain.33569 > my-server-ip-addr.static.servdns.com.smtp: Flags [S], seq 4281180544, win 14600, options [mss 1460,sackOK,TS val 6526374 ecr 0,nop,wscale 7], length 0
13:02:53.198111 IP localhost.localdomain.33569 > my-server-ip-addr.static.servdns.com.smtp: Flags [S], seq 4281180544, win 14600, options [mss 1460,sackOK,TS val 6528376 ecr 0,nop,wscale 7], length 0
during the same time period on the server, I got:
tcpdump -i any tcp port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
 
@CodeMed try again with the -n flag: tcpdump -n -i any tcp port 25 on the client... localhost.localdomain sounds like its trying to make the connection with a source IP of 127.0.0.1
 
the ip listed in the client output is the server ip address, but with dashed instead of dots. so it says my-server-ip-addr and NOT my.server.ip.addr
 
(and sending a connection over the Internet with a source IP of 127.anything would be very broken)
 
thunderbird is trying now, with tcpdump -n -i any tcp port 25 running on both client and server. i will post results when thunderbird times out.
results on the client machine while thunderbird was trying to send were:
tcpdump -n -i any tcp port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
13:10:44.666109 IP 10.0.0.2.33581 > my.server.ip.addr.smtp: Flags [S], seq 3970906254, win 14600, options [mss 1460,sackOK,TS val 6999844 ecr 0,nop,wscale 7], length 0
13:10:46.670119 IP 10.0.0.2.33581 > my.server.ip.addr.smtp: Flags [S], seq 3970906254, win 14600, options [mss 1460,sackOK,TS val 7001848 ecr 0,nop,wscale 7], length 0
results on the server during the same time period while thunderbird was tryng to send were:
tcpdump -n -i any tcp port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
note that my.server.ip.addr now uses dots instead of dashes.
 
9:16 PM
Yep. -n will do that. The one with dashes is actually your host name in DNS.
So your dev box is sending the packets. For some reason, they aren't showing up at the server.
Try tcpdump -n -i any tcp port 12345 on the server, then nc -q 1 server 12345 < /dev/null on the client.
12345 is just a port number I made up, which is probably unused.
 
ok. so i literally type 12345?
 
Sure. Or make up your own number, as long as its between 1025 and 65535.
 
on the client, i got:
nc -q 1 server 12345 < /dev/null
nc: invalid option -- 'q'
Ncat: Try `--help' or man(1) ncat for more information, usage options and help. QUITTING.
 
ok, leave off the -q 1 part, then
 
below are the results of two ways of reconciling the word server in that command, when run in the devbox terminal:
# nc mydomain.com 12345 < /dev/null
Ncat: No route to host.

# nc my.server.ip.addr 12345 < /dev/null
Ncat: No route to host.
is this a firewalld thing on the server?
 
9:25 PM
No route to host is a weird error! What did the tcpdump on the server say?
(And using the IP address for the server is fine.)
 
no results on server.
 
@CodeMed Can you connect to the server at all from your devbox?
 
i can connect via imap and via openvpn
copied from above, the open firewall services in the public zone are:
firewall-cmd --list-all
public (default, active)
interfaces: enp3s0
sources:
services: dhcpv6-client imaps openvpn smtp
ports:
masquerade: yes
forward-ports:
icmp-blocks:
rich rules:
 
@CodeMed so if you use 143 in that nc line, it doesn't produce an error?
 
imaps and openvpn work, but smtp does not
 
9:33 PM
sorry, 993 then for imaps
nc server-ip 993 < /dev/null
also change the tcpdump to 993
 
i changed 143 to 993 in the imaps.xml file
so the nc command with 143 gives
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready.
 
Ok. That's a reasonable IMAP hello. And the tcpdump on the server showed a bunch of lines?
 
the tcpdump on the server did not show anything because it is filtering for port 12345. i will re-run it now with the server filtering on port 143
when i just now typed Ctrl-C on the server, it said 3 packets were received but did not itemize them.
 
did you have -n in there?
 
yes
 
9:39 PM
and both your netcat and your tcpdump were on the same port?
 
not at that time. but just now i ran them on the same port and there are several itemized results on the server. shall i anonymize the results and post them? the ip of the server and devbox are correct in the results. then just now perhaps 15 more lines were printed on the server
 
@CodeMed no need to post
OK, so when you send traffic on 143, it gets through. When you send it on other ports, it isn't seen at all on the remote end...
I checked on one of my machines, even if the firewall on the server drops it, the tcpdump there will still see it.
So there is another firewall somewhere dropping the packets.
You have a 10.x IP address for your dev box, so there is one on that side, doing NAT if nothing else.
 
what is NAT?
 
network address translation
 
my thunderbird has several accounts that are all able to send and receive email on other servers.
 
9:45 PM
So it's probably not on your side, then. Is there a firewall in front of the server?
 
no. it is a development server. just barebones firewalld
 
Hmmm, you could try using a third-party to test to see if they can talk to the server (Google "smtp server test"). That'd confirm which side its on.
I'd leave the tcpdump on port 25 running on the server while attempting
 
yeah, that should work
 
when using mydomain.com for the smtp server name, and a correct username, with a correct recipient, the result was:
ERROR: Invalid email address.
Message sending failed.
 
9:51 PM
Did tcpdump on the server show traffic?
 
no
tcpdump -n -i any tcp port 25
 
Oh, wait, that error is from the test site, saying you didn't fill out the form correctly.
Both of those are email addresses, not usernames
They don't have to be real—you could use test@example.com
 
yes. i typed username and not username@mydomain.com
i have results now. let me anonymize them before posting here
Connecting...
SMTP -> FROM SERVER:
220 mydomain.com ESMTP Postfix
SMTP -> FROM SERVER:
250-mydomain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: me@mydomain.com
SMTP -> FROM SERVER:
250 2.1.0 Ok
RCPT TO: someother@testaccount.com
SMTP -> FROM SERVER:
454 4.7.1 : Relay access denied
SMTP -> ERROR: RCPT not accepted from server: 454 4.7.1 : Relay access denied

Message sending failed.
 
@CodeMed and presumably tcpdump showed a bunch of stuff?
 
yes, on my server, tcpdump shows the following:
tcpdump -n -i any tcp port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
16:49:59.523835 IP 184.72.226.23.51373 > my.server.ip.addr.smtp: Flags [.], ack 3738288483, win 229, options [nop,nop,TS val 1512370084 ecr 974829510], length 0
16:49:59.623859 IP my.server.ip.addr.smtp > 184.72.226.23.51373: Flags [P.], seq 1:43, ack 0, win 114, options [nop,nop,TS val 974829642 ecr 1512370084], length 42
 
9:57 PM
@CodeMed OK, so random other people can speak SMTP to your server, but you can't... That leads pretty strongly to there being a firewall on your side blocking it.
 
where the 184... is the ip of the other web site that initiated the test, while my.server.ip.addr is the actual ip of my server
ok. so then what do i do?
 
What's your networking setup like and do you administer it?
 
my devbox is connected to a high-speed modem. my devbox is the only machine on my local network. i control it
 
Ok. This is a modem provided by your ISP?
 
yes
 
10:01 PM
And does iptables -v -L OUTPUT on the dev box (client) show anything?
 
iptables -v -L OUTPUT
Chain OUTPUT (policy ACCEPT 489K packets, 43M bytes)
pkts bytes target prot opt in out source destination
489K 43M OUTPUT_direct all -- any any anywhere anywhere
 
Ok. So you don't have any firewall rules blocking outgoing traffic on your box.
wait, actually, what's OUTPUT_direct ?
 
i can google it
 
iptables -v -L OUTPUT_direct should display it, I think
 
iptables -v -L OUTPUT_direct
Chain OUTPUT_direct (1 references)
pkts bytes target prot opt in out source destination
 
10:04 PM
OK, so that's empty, so indeed no rules blocking outgoing
I would guess your ISP is blocking port 25. I'm confused by 12345, they shouldn't be blocking that. (And the unreachable is even weirder, that's not the message I'd expect—you sure there wasn't a typo there, say in the server IP?)
 
i am searching for the word unreachable in this thread to find what you are referring to but no results. what should i check?
 
43 mins ago, by CodeMed
# nc mydomain.com 12345 < /dev/null
Ncat: No route to host.

# nc my.server.ip.addr 12345 < /dev/null
Ncat: No route to host.
... there it is
"no route to host", not unreachable, my mistake
 
do you mean: nc my.server.ip.addr 12345 < /dev/null
 
yeah, I'm curious if you maybe made a typo in the server IP address.
 
for port 143, that command gives live results.
for port 12345 it gives no route to hose
host
for port 25, it gives connection timed out.
 
10:10 PM
weird. What about a different port number, say 16762 (a random number I just made up)?
 
for 16762 it gives no route to host.
i can call my isp, but is that the solution?
 
I'm not sure what to make of that...
But smtp at least works for the random third party you tried.
 
should i assume that my isp is the only gatekeeper between my devbox and my server? or is there some chain of gatekeepers that i would need to check for?]
 
And I'm guessing you haven't set up anything like policy-based routing on your dev box (and if you have no idea what that is, the answer is almost certainly "no")
@CodeMed There may be firewalls at wherever is hosting your server as well.
 
so my isp and my server host. who else?
 
10:14 PM
@CodeMed There are other parties between, most likely, but it'd be extremely odd for any of them to be doing something.
Plus, you're not really their customer, so its much harder to call them.
 
i just dialed my server host
on hold. smooth jazz ... sorry for the delay. i will type when i get a reply from them.
 
OK. FYI, I'm heading out soon.
 
10:42 PM
the web host pointed out that the other working email servers are on a different port than 25, and that my problem is that my isp is blocking port 25. he said the solution is to change the smtp port in the postfix conf file, in firewalld, and in my remote thunderbird to some other port, such as for example 465
 
10:53 PM
@CodeMed that'd make sense.
 
587 would be the standard number
 
/etc/postfix/master.cf does not seem to have anything relevant in it. perhaps because the default file does not contain all the options
 
Not sure. I personally use exim :-P
 
11:16 PM
I changed /etc/postfix/master.cf and /usr/lib/firewalld/services/smtp.xml to indicate port 465. i also changed the smtp port in thunderbird to 465, then i tried to get thunderbird to send an email. the connection still timed out, but this is what i got on the server:
tcpdump -n -i any tcp port 465
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
18:07:36.276193 IP my.SERVER.ip.addr.urd > my.DEVBOX.ip.addr.37589: Flags [S.], seq 3232257854, ack 2935370285, win 14480, options [mss 1460,sackOK,TS val 979486294 ecr 14200749,nop,wscale 7], length 0
18:07:36.361712 IP my.DEVBOX.ip.addr.37589 > my.SERVER.ip.addr.urd: Flags [.], ack 1, win 115, options [nop,nop,TS val 14200832 ecr 979486294], length 0
should i post another question? not sure if this is in your scope if you use exim instead of postfix....unless the message is useful to you...
 
@CodeMed odd it timed out, that tcpdump looks like its working
 
nc my.server.ip.addr 465 < /dev/null
220 mydomain.com ESMTP Postfix
the last 2 lines were from the devbox client
now it is not receiving email either. i wonder if i should write a question about changing the smtp port in postfix.
i added the bottom one line to master.cf:
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
465 inet n - - - - smtpd #this is the line i added (without the comment)
i think it has to do with needing to set up a relay host so that sending goes through 465, but so that other domains can use 25 to put inbound email into the MTA. if this is not your area, i can just write another question. you have helped a lot.
 
11:57 PM
@CodeMed I doubt I can be much help. But I see Anthony is already on the case.
For the record, I use exim too.
 
Thank you. I just posted a separate question related to setting up a relay host.
 
@CodeMed Ok. So are you set then?
 

  last day (16 days later) »