My Internet provider just started using CGN (Carrier-Grade NAT), so I’m no longer receiving a public IPv4 address for my router and can't acces my homeserver from outside. Therefore I rent a virtual private server (with a static IP addresse) and run a OpenVPN server. A VPN client on my homeserver connects to this VPN server and bridge the VPN network with my local network. All works fine and I can access my home network from outside. The traffic from homeserver is tunneled through the OpenVPN connection. The only big problem: [b]I can't connect from homeserver through OpenVPN tunnel to external mailservers on port 25 (for example Gmail). Why?! :roll: [/b] If I try to connect to external mailserver on port 25 from virtual private server directly, the connection works fine. The problem only occurs through the VPN tunnel. The connection with telnet failes: [quote]root@homeserver # telnet smtp.gmail.com 25 Trying 108.177.119.109... [/quote] The output of traceroute: [quote] [130]root@homeserver # traceroute -n -T -p 25 smtp.gmail.com traceroute to smtp.gmail.com (108.177.119.109), 30 hops max, 60 byte packets 1 108.177.119.109 73.849 ms 73.857 ms 74.518 ms 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * [/quote] My configs looks like: SERVER CONFIG: [oconf=Server Config] dev tun proto udp port 1194 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem user nobody group nogroup server 10.8.0.0 255.255.255.0 persist-key persist-tun status /var/log/openvpn-status.log verb 3 client-to-client push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 85.214.20.141" push "dhcp-option DNS 8.8.8.8" log-append /var/log/openvpn comp-lzo [/oconf] IPTABLES SCRIPT (OpenVPN Server): [oconf=Iptables] echo "1" > /proc/sys/net/ipv4/ip_forward iptables -A INPUT -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -t nat -F POSTROUTING iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE iptables -t nat -A PREROUTING -p tcp -m tcp --dport 993 -j DNAT --to-destination 10.8.0.6:993 iptables -t nat -A PREROUTING -p tcp -m tcp --dport 143 -j DNAT --to-destination 10.8.0.6:143 iptables -t nat -A PREROUTING -p tcp -m tcp --dport 465 -j DNAT --to-destination 10.8.0.6:465 iptables -t nat -A PREROUTING -p tcp -m tcp --dport 587 -j DNAT --to-destination 10.8.0.6:587 iptables -t nat -A PREROUTING -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.8.0.6:22 [/oconf] The homeserver uses the following config to connect to the OpenVPN server: CLIENT CONFIG: [oconf=Client Config] dev tun client proto udp remote xx.xx.xx.xx 1194 resolv-retry infinite nobind persist-key persist-tun ca "/etc/openvpn/easy-rsa/keys/ca.crt" cert "/etc/openvpn/easy-rsa/keys/homeserver.crt" key "/etc/openvpn/easy-rsa/keys/homeserver.key" comp-lzo verb 3 [/oconf]

As the server is a VPS you may need to use different iptables rule (Use the correct VPN subnet 10.*): [code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 12.34.56.78 #

Thank you for your reply. I just tried it, but it has no effect...

Remove all the other rules from iptables to test it properly and try using tcpdump on the server to verify what packets are sent where and with what source IP.

The crazy thing is that for example port 80 works, port 25 does not work. [quote] root@homeserver # telnet www.gmail.com 80 Trying 172.217.17.69... Connected to googlemail.l.google.com. Escape character is '^]'. [/quote] [quote] root@homeserver # telnet gmail-smtp-in.l.google.com 25 Trying 108.177.119.27... [/quote]

Does google listen on plaintext smtp ? That would surprise me ..

When I do the same on the virtual private server, the connection works: [quote] root@vps # telnet gmail-smtp-in.l.google.com 25 Trying 108.177.119.27... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP p6si7052731edh.290 - gsmt [/quote] The connection problem occurs only with VPN tunnel When I disconnect the VPN connection, the SMTP connection from homeserver works again

Maybe your VPS blocks plaintext smtp .. ?

[quote=TinCanTech post_id=73185 time=1507041927 user_id=37053] Does google listen on plaintext smtp ? That would surprise me .. [/quote] every SMTP server has to listen on port 25 (plaintext) on the internet , but it can advertise starttls support in which case the connection would be "upgraded" to TLS anyhow, [b]k00b0ld[/b] are you sure that your connection goes out through the VPN tunnel and not your ISP? did you try what [b]TinCanTech[/b] suggested ? ... to use tcpdump and see if traffic goes where you think or should go

[quote=TiTex post_id=73192 time=1507049770 user_id=15056] [quote=TinCanTech post_id=73185 time=1507041927 user_id=37053] Does google listen on plaintext smtp ? That would surprise me .. [/quote] every SMTP server has to listen on port 25 (plaintext) on the internet [/quote]Oops .. I forgot about that :D

Yes, I'm sure that the connection goes out through the VPN. Whithout VPN connection the homeserver can connect to mailservers on port 25. The problem occurs only with port 25, all other connections seem to work. Here is the output of tcpdump, running on the virtual private server, for a SMTP connection (which always failes): [quote] 19:21:50.210770 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0 19:21:50.210825 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190598863 ecr 0,nop,wscale 6], length 0 19:21:51.209583 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599113 ecr 0,nop,wscale 6], length 0 19:21:51.209611 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599113 ecr 0,nop,wscale 6], length 0 19:21:53.210162 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599614 ecr 0,nop,wscale 6], length 0 19:21:53.210189 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190599614 ecr 0,nop,wscale 6], length 0 19:21:57.220439 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190600616 ecr 0,nop,wscale 6], length 0 19:21:57.220469 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190600616 ecr 0,nop,wscale 6], length 0 19:22:05.240720 IP 10.8.0.6.53713 > 108.177.119.26.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190602620 ecr 0,nop,wscale 6], length 0 19:22:05.240748 IP 10.8.0.6.53713 > 10.8.0.6.smtp: Flags [S], seq 2057581401, win 14600, options [mss 1368,sackOK,TS val 190602620 ecr 0,nop,wscale 6], length 0 [/quote] For comparison the output of tcpdump for a POP3 connection, that works: [quote] 19:22:18.639740 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [S], seq 1280631682, win 14600, options [mss 1368,sackOK,TS val 190605971 ecr 0,nop,wscale 6], length 0 19:22:18.655456 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [S.], seq 2148291562, ack 1280631683, win 28960, options [mss 1460,sackOK,TS val 4086145739 ecr 190605971,nop,wscale 9], length 0 19:22:18.719480 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [.], ack 1, win 229, options [nop,nop,TS val 190605991 ecr 4086145739], length 0 19:22:18.720108 IP 10.8.0.6.36159 > pop.gmx.net.pop3s: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 190605992 ecr 4086145739], length 517 19:22:18.736362 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 0 19:22:18.739371 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], seq 1:1357, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 1356 19:22:18.739395 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], seq 1357:2713, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 1356 19:22:18.739397 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [.], seq 2713:4069, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 1356 19:22:18.739398 IP pop.gmx.net.pop3s > 10.8.0.6.36159: Flags [P.], seq 4069:5062, ack 518, win 59, options [nop,nop,TS val 4086145760 ecr 190605992], length 993 [/quote]

Vpn-Client can't connect to hosts on port 25 (SMTP)

k00b0ld

SOLVED!
Thank you for taking me to the right track. 🙂

After I had posted the above output, I have tested the connection again. It worked suddenly?! What has changed?

I just noticed that the problem only occurs when the following iptable rule exists:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.6:25

Without the rule, the connection to port 25 will work properly.
I changed the rule and everything seems to work:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.8.0.6:25

TiTex

:? you have not included that rule in the above iptables output or your opening message

k00b0ld

Yes, that was my fault. :?
While trying to solve the problem I cleared the iptables rules several times and added the PREROUTING part later. This makes me notice this connection quite late. Thanks for your help! Your hint to the strange route was crucial.

« Previous Page