Vpn-Client can't connect to hosts on port 25 (SMTP)

k00b0ld

My Internet provider just started using CGN (Carrier-Grade NAT), so I’m no longer receiving a public IPv4 address for my router and can't acces my homeserver from outside.

Therefore I rent a virtual private server (with a static IP addresse) and run a OpenVPN server. A VPN client on my homeserver connects to this VPN server and bridge the VPN network with my local network. All works fine and I can access my home network from outside. The traffic from homeserver is tunneled through the OpenVPN connection.

The only big problem:
I can't connect from homeserver through OpenVPN tunnel to external mailservers on port 25 (for example Gmail). Why?! :roll:

If I try to connect to external mailserver on port 25 from virtual private server directly, the connection works fine. The problem only occurs through the VPN tunnel.

The connection with telnet failes:

root@homeserver # telnet smtp.gmail.com 25
Trying 108.177.119.109...

The output of traceroute:

[130]root@homeserver # traceroute -n -T -p 25 smtp.gmail.com
traceroute to smtp.gmail.com (108.177.119.109), 30 hops max, 60 byte packets
1 108.177.119.109 73.849 ms 73.857 ms 74.518 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *

My configs looks like:

SERVER CONFIG:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
client-to-client
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 85.214.20.141"
push "dhcp-option DNS 8.8.8.8"
log-append /var/log/openvpn
comp-lzo

IPTABLES SCRIPT (OpenVPN Server):

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 993 -j DNAT --to-destination 10.8.0.6:993
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 143 -j DNAT --to-destination 10.8.0.6:143
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 465 -j DNAT --to-destination 10.8.0.6:465
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 587 -j DNAT --to-destination 10.8.0.6:587
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.8.0.6:22

The homeserver uses the following config to connect to the OpenVPN server:

CLIENT CONFIG:

dev tun
client
proto udp
remote xx.xx.xx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "/etc/openvpn/easy-rsa/keys/ca.crt"
cert "/etc/openvpn/easy-rsa/keys/homeserver.crt"
key "/etc/openvpn/easy-rsa/keys/homeserver.key"
comp-lzo
verb 3

TinCanTech

As the server is a VPS you may need to use different iptables rule (Use the correct VPN subnet 10.*):

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 12.34.56.78   # <-- Use your OpenVPN server's real external IP here and select the correct interface for ethX

k00b0ld

Thank you for your reply. I just tried it, but it has no effect...

TinCanTech

Remove all the other rules from iptables to test it properly and try using tcpdump on the server to verify what packets are sent where and with what source IP.

k00b0ld

The crazy thing is that for example port 80 works, port 25 does not work.

root@homeserver # telnet www.gmail.com 80
Trying 172.217.17.69...
Connected to googlemail.l.google.com.
Escape character is '^]'.

root@homeserver # telnet gmail-smtp-in.l.google.com 25
Trying 108.177.119.27...

TinCanTech

Does google listen on plaintext smtp ? That would surprise me ..

k00b0ld

When I do the same on the virtual private server, the connection works:

root@vps # telnet gmail-smtp-in.l.google.com 25
Trying 108.177.119.27...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP p6si7052731edh.290 - gsmt

The connection problem occurs only with VPN tunnel
When I disconnect the VPN connection, the SMTP connection from homeserver works again

TinCanTech

Maybe your VPS blocks plaintext smtp .. ?

TiTex

TinCanTech wrote Does google listen on plaintext smtp ? That would surprise me ..

every SMTP server has to listen on port 25 (plaintext) on the internet , but it can advertise starttls support in which case the connection would be "upgraded" to TLS

anyhow, k00b0ld are you sure that your connection goes out through the VPN tunnel and not your ISP?
did you try what TinCanTech suggested ? ... to use tcpdump and see if traffic goes where you think or should go

TinCanTech

TiTex wrote
TinCanTech wrote Does google listen on plaintext smtp ? That would surprise me ..
every SMTP server has to listen on port 25 (plaintext) on the internet

Oops .. I forgot about that 😃

k00b0ld

Yes, I'm sure that the connection goes out through the VPN.
Whithout VPN connection the homeserver can connect to mailservers on port 25.
The problem occurs only with port 25, all other connections seem to work.

Here is the output of tcpdump, running on the virtual private server, for a SMTP connection (which always failes):

19:21:50.210770 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0
19:21:50.210825 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0
19:21:51.209583 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599113 ecr 0,nop,wscale 6], length 0
19:21:51.209611 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599113 ecr 0,nop,wscale 6], length 0
19:21:53.210162 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599614 ecr 0,nop,wscale 6], length 0
19:21:53.210189 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599614 ecr 0,nop,wscale 6], length 0
19:21:57.220439 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190600616 ecr 0,nop,wscale 6], length 0
19:21:57.220469 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190600616 ecr 0,nop,wscale 6], length 0
19:22:05.240720 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190602620 ecr 0,nop,wscale 6], length 0
19:22:05.240748 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190602620 ecr 0,nop,wscale 6], length 0

For comparison the output of tcpdump for a POP3 connection, that works:

19:22:18.639740 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [S], seq 1280631682, win 14600, options [mss 1368,sackOK,TS val 190605971 ecr 0,nop,wscale 6], length 0
19:22:18.655456 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [S.], seq 2148291562, ack 1280631683, win 28960, options [mss 1460,sackOK,TS val 4086145739 ecr 190605971,nop,wscale 9], length 0
19:22:18.719480 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [.], ack 1, win 229, options [nop,nop,TS val 190605991 ecr 4086145739], length 0
19:22:18.720108 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 190605992 ecr 4086145739], length 517
19:22:18.736362 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 0
19:22:18.739371 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], seq 1:1357, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 1356
19:22:18.739395 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], seq 1357:2713, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 1356
19:22:18.739397 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], seq 2713:4069, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 1356
19:22:18.739398 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [P.], seq 4069:5062, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 993

k00b0ld

TinCanTech wrote Maybe your VPS blocks plaintext smtp .. ?

No, the VPS doesn't block port 25. It looks like OpenVPN blocks port 25.
See my post:

k00b0ld wrote When I do the same on the virtual private server, the connection works:
root@vps # telnet gmail-smtp-in.l.google.com 25
Trying 108.177.119.27...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP p6si7052731edh.290 - gsmt
The connection problem occurs only with VPN tunnel
When I disconnect the VPN connection, the SMTP connection from homeserver works again

TiTex

have you tried some other mail server , i mean find some corporate mail server just for testing or maybe the school/workplace mailserver
this looks very strange to me

root@homeserver # traceroute -n -T -p 25 smtp.gmail.com
traceroute to smtp.gmail.com (108.177.119.109), 30 hops max, 60 byte packets
1 108.177.119.109 73.849 ms 73.857 ms 74.518 ms

first hop is the IP address that smtp.gmail.com resolves to ? can you try without pushing the DNS options from (vpn) server to client and remove 'bypass-dhcp' from server config just for testing ?

k00b0ld

I have tried several mail servers - no connection to port 25 via vpn tunnel.
The problem is independent of DNS. Whether I use the IP or hostname - no connection on port 25. All other ports seem to work.
I also removed 'bypass-dhcp' and pushing DNS from vpn server. No change ...

I even tried a second vps, which I configured also as openvpn server. The problem remains the same. :?

TiTex

also take a look at the packet capture
19:21:50.210770 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0
19:21:50.210825 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0

vs

19:22:18.639740 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [S], seq 1280631682, win 14600, options [mss 1368,sackOK,TS val 190605971 ecr 0,nop,wscale 6], length 0
19:22:18.655456 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [S.], seq 2148291562, ack 1280631683, win 28960, options [mss 1460,sackOK,TS val 4086145739 ecr 190605971,nop,wscale 9], length 0

can you do an ipconfig/ifconfig on your server(s) and post the result ? both with and without the vpn tunnel established ?
also your firewall (iptables) rules on both servers, you can redact the sensible information like public IP

k00b0ld

SERVER:

root@vps # ifconfig
eth0 Link encap:Ethernet Hardware Adresse 52:54:00:ab:52:c5
inet Adresse:xx.xx.xx.xx Bcast:xx.xx.xx.xx Maske:255.255.255.240
inet6-Adresse: xxxx::xxxx:xx:xxxx:xxxx/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:279792 errors:0 dropped:0 overruns:0 frame:0
TX packets:88636 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:36249033 (34.5 MiB) TX bytes:26753727 (25.5 MiB)

eth1 Link encap:Ethernet Hardware Adresse 52:54:c9:c0:59:0e
inet Adresse:172.23.0.10 Bcast:172.23.255.255 Maske:255.255.0.0
inet6-Adresse: fe80::5054:c9ff:fec0:590e/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:0 (0.0 B) TX bytes:728 (728.0 B)

lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
UP LOOPBACK RUNNING MTU:65536 Metrik:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

tun0 Link encap:UNSPEC Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet Adresse:10.8.0.1 P-z-P:10.8.0.2 Maske:255.255.255.255
UP PUNKTZUPUNKT RUNNING NOARP MULTICAST MTU:1500 Metrik:1
RX packets:1417 errors:0 dropped:0 overruns:0 frame:0
TX packets:1622 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX bytes:220506 (215.3 KiB) TX bytes:388277 (379.1 KiB)

Without etablished vpn tunnel:

root@vps # ifconfig
eth0 Link encap:Ethernet Hardware Adresse 52:54:00:ab:52:c5
inet Adresse:xx.xx.xx.xx Bcast:xx.xx.xx.xx Maske:255.255.255.240
inet6-Adresse: xxxx::xxxx:xx:xxxx:xxxx/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:282250 errors:0 dropped:0 overruns:0 frame:0
TX packets:89415 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:36541349 (34.8 MiB) TX bytes:26951081 (25.7 MiB)

eth1 Link encap:Ethernet Hardware Adresse 52:54:c9:c0:59:0e
inet Adresse:172.23.0.10 Bcast:172.23.255.255 Maske:255.255.0.0
inet6-Adresse: fe80::5054:c9ff:fec0:590e/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:0 (0.0 B) TX bytes:728 (728.0 B)

lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
UP LOOPBACK RUNNING MTU:65536 Metrik:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

Iptables:

root@vps # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

TinCanTech

# iptables -t nat -L

k00b0ld

SERVER

root@vps # iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:imaps to:10.8.0.6:993
DNAT tcp -- anywhere anywhere tcp dpt:urd to:10.8.0.6:465
DNAT tcp -- anywhere anywhere tcp dpt:submission to:10.8.0.6:587

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere

CLIENT (homeserver)

root@homeserver # iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

TiTex

i don't see anything wrong in your setup , but back from the packet capture there's something clearly wrong with your routing/nat somewhere.

19:21:50.210770 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0
19:21:50.210825 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0

i'm curious if this happens if you try from another PC in your home network , if it does and you have everything configured correctly then i'd say your ISP is blocking it ... maybe they have some kind of vpn filtering , i don't have any other explanation 🙂

TinCanTech

TiTex wrote i don't see anything wrong in your setup , but back from the packet capture there's something clearly wrong with your routing/nat somewhere.

19:21:50.210825 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0

Why are you trying to connect to 10.8.0.6.smtp ?