Problem creating SMTP rule on watchguard X core

Hi there I apologise I shoudl have said I was using telnet on port 25 (Not 23) I'm trying to test SMTP connections.

Many thanks

While you're attempting the telnet, review the WatchGuard Traffic Monitor - if the Firebox is blocking, then it will let you know specifically what is happening.  Can you post a print screen of your Traffic Monitor?

I can post almost anything :-)

Here is the output when I attempt to telnet

10/14/09 19:44  firewalld[121]:  deny in eth0 235 udp 20 128 217.112.85.1 217.112.85.255 138 138 (default)
10/14/09 19:45  smtp-proxy[227]:  [217.112.85.1:64341 192.168.1.1:25] proxy connect failed (Connection timed out)

FYI

217.112.85.1 is my laptop pretending to be a router/gateway  hence why I gacve you the output and not a screeny loads of winodws tye stuff getting bounced. If you think it is relelvant I'll post it though.

I get the same error if I add  217.xxx.xxx.1 to the exceptiosmn list.

10/14/09 19:54  smtp-proxy[641]:  [217.112.85.1:53998 192.168.1.1:25] proxy connect failed (Connection timed out)

 Also I'm going to try some other configurations and I'll add that later.

Thanks

Good Morning,

It will be helpful if you could include the print screen of the Traffic Monitor.  It'll be easier to read that way.  

Thanks,
LJ

HI there, I do apologise for not replying, anyway in the end I ended up getting the HA licence and updating to 10.11 and since then I've been to busy to do anything. I'll update as soon as I can. I notice the interface is substantially changed in 10.11 from that of 7, so guess I'll be going what does that do again!! I';ll post as soon as I have time to get to grips with this.

Thanks so far

David

Right Well I've just finished looking at the new interface and had a play and have decided I'm moron, I can't get SMTP to pass through at all.

Infact when I telnet on 25 I can now see

2009-10-20 23:53:06 Deny 90.211.64.196 xxx.xxx.xxx.xxx smtp/tcp 2819 25 2-External 2 Firebox denied 48 123 (Unhandled External Packet-00) tcpinfo="offset 7 S 900223125 win 65535" rc="101" Traffic

 xxx of course is the external facing ip of my SMTP server (well it will be if I ever get it to work).

Here's how it stands so far

If you need to see more let me know.

David

Ahh yes the traffic mon screeny as well, I've blocked out my IP as this is now in my rack (No point giving any script kiddies and info they don't need)

My telnet is highlighted as denied.

Good Morning David,

Why do you have 2 devices being Natted to the same internal IP?  Which one of the resources is the actual Exchange server?  Have you actually tested sending and receiving email through the Firebox?  Are you assuming that because you cannot telnet you will not be able to send and receive email?

LJ

Also, so that we can get more detailed information in Traffic Monitor, can you use the SMTP proxy policy instead of filtered?

Thanks,
LJ

Hi there,

To give you the low down it's not an exchange box (Unix based email)  CGP which is awesome. As an email server. I'll explain the two external feeds. I have two netblocks one is currenly on another fierwall but will be directed to this firewall when and if I can resolve this issue. It's still on because I can't see a way of simply switching the interface off as opposed to deleting what I've already setup.

As to telnet on port 25 then if I can't do that then email won't reach the mail server.

i.e  telnet smtp.mymailserver.com 25 should return something like:

220 smtp.mymailserver.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready at  Wed, 21 Oct 2009 14:17:56 +0100

If it was Exchange and something like: 220 2kcafe.co.uk ESMTP CommuniGate Pro 5.XX.XX is glad to see you! for the mail server I run.

I'll setup the proxy I did that initially and that didn't work either. I'll get on and do that now.

Cheers

David

Well very weird:

2009-10-21 14:39:10 Allow 90.211.64.196 192.168.1.1 tcp 4230 25 2-External 2 1-Internal Trusted 1 Connect timeout (SMTP-proxy for Externral 2-00) SMTP-Incoming rc="590" proxy_act="SMTP-Incoming" Traffic

I get an allow now, and I guess the time out I get now is because the gateway for the SMTP server isn't the same. I'll try later tonight when I have a chance to edit gateways etc without screwing up anyone email.

CHeers so far.

David

Good Afternoon David,

How are things going with the Firebox and SMTP traffic?

LJ

Hello there, right after much banging of my head testing and staying up late at night to try this out, I've come to the conclusion that there appears to be a problem with /24 networks on the external network. I'll try an explain.

I've got the pro licence for this up and running as I've got two seperate feeds one on a 94 range and the other on a 217. now the way the ISP presents this to us is very differnet for each range. for the 94 I've got a /27 subnet however for our 217 this is /24 by this I mean I have 13 ip's but they've not subnetted so what we have to do is make sure we have the correct aliases in. A bit like this

I have 217.xxx.xxx.172 as my nic address, however I also have
217.xxx.xxx.171
217.xxx.xxx.170
217.xxx.xxx.179
217.xxx.xxx.173
217.xxx.xxx.171
217.xxx.xxx.165
217.xxx.xxx.164  

Not a Contiguous block as you can see, this works fine on our old firewall but it's failing but for the life of me I can't get this to work on the Firebox, Now there must be a way of getting the external netwrok to work on /24 but as I said it's not working for us.

Thanks for the patience, it's taken time as I'm trying this is the live environment so have to do the workl really late as we have a big arsed mail server on it.

David