0

I've been struggling with an issue between two mail servers behind my Sonicwall NSA 2400. Both servers interact with the outside world just fine, but they cannot successfully send e-mail to each other. Here's the setup:

There are three interfaces on the NSA 2400 at play here: X0, X2, and X4.

SERVER1 (my email server)
Interface: X0
Internal IP: 192.168.1.5 (255.255.255.0)
Public IP: 10.9.8.7 (255.255.255.240)

SERVER2 (not my email server, but connected to same firewall on different interface)
Interface: X2
Internal IP: 192.168.2.6 (255.255.255.0)
Public IP: 10.9.8.4 (255.255.255.240)

Both the X0 and the X2 interface are in the LAN zone (to use Sonicwall terminology), but different subnets. The external IPs of both machines are in teh same subnet in the WAN zone on interface X4.

The firewall is set to allow traffic from LAN -> WAN, WAN -> LAN, LAN -> LAN, and WAN -> WAN on port 25 in both directions between the two servers. Each server is attempting to locate each other using the public IP. The public IPs NAT to the respective internal IPs for both inbound and outbound traffic and I know that it's done correctly since our mail servers are having no issues with any other mail servers.

I've done packet traces and I seem to be getting a TCP handshake error. I can't really figure out much beyond that.

Improve this question
1
  • 10.9.8.7 and 10.9.8.4 are not public (routable) ip addresses.
    – joeqwerty
    Mar 11, 2011 at 17:34

1 Answer 1

Reset to default
1

If you don't have NAT rules specifically handling traffic from internal subnets (generally called Firewalled Subnets) to external IPs of those internal machines, you need them. In my config they go something like this:

Original Source: Firewalled Subnets  
Translated Source: [public IP of server]   
Original Destination: [public IP of server]   
Translated Destination: [private IP of server]
Improve this answer
1
  • hwilbanks, I worked with Sonicwall tech support and you're correct, but there's another piece to it. In the LAN to LAN rules, I have to (counterintuitively) add a rule that says allow SMTP from SERVER1's internal IP to SERVER2's external IP (even though SERVER2's external IP is a WAN network object). Then obviously I have to create the opposite rule from SERVER2 to SERVER1.
    – pk.
    Mar 11, 2011 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .