0

I'm trying to get a mail server to support IMAP-over-SSL services. Everything is fine inside my network: Clients can specify SSL and port 993 in their email client configuration, and mail gets through. However, it's not working from outside: Somewhere, the port is getting blocked.

Nmap tells me this for the internal network:

[root@linux2 ~]# nmap -p993 192.168.0.4
Starting Nmap 5.21 ( http://nmap.org ) at 2011-04-18 09:54 PDT
Nmap scan report for example.com (192.168.0.4)
Host is up (0.00022s latency).
PORT    STATE SERVICE
993/tcp open  imaps
MAC Address: 00:1F:5B:35:F4:C8 (Apple)

And for the outside network:

[root@linux2 ~]# nmap -p993 xxx.xxx.xxx.xxx 
Starting Nmap 5.21 ( http://nmap.org ) at 2011-04-18 09:54
PDT Nmap scan report for example.com (xxx.xxx.xxx.xxx) 
Host is up (0.0023s latency). 
PORT    STATE SERVICE 
993/tcp filtered imaps

So, somebody is doing some filtering; the question is who. My router's firewall has 993 open; I've also experimented with (briefly) disabling the router firewall altogether, but with no improvement. I've checked with my service provider (AT&T DSL), but they say they're not blocking it.

6
  • 1
    Was that computer actually outside the internal network when you used nmap? Depending on your router (not sure if its always true) you cannot access your external IP/port from inside the network. Which is where split DNS comes in handy...
    – xeon
    Apr 18, 2011 at 18:26
  • The latency on the nmap outputs makes me think Xeon is right and it's not truly outside the network. Can you nmap from far away? 'Filtered' usually means TCP wrappers or firewalling but could be indicative of the external IP issue Xeon mentioned. Apr 18, 2011 at 18:43
  • OK, I'm back from Starbucks with my laptop. The results are essentially what I've seen before: Starting Nmap 5.51 ( nmap.org ) at 2011-04-19 14:57 PDT Nmap scan report for example.com (xxx.xxx.xxx.xxx) Host is up (0.20s latency). Not shown: 837 closed ports, 152 filtered ports PORT STATE SERVICE 25/tcp open smtp 53/tcp open domain 80/tcp open http 110/tcp open pop3 143/tcp open imap 548/tcp open afp 995/tcp open pop3s 3031/tcp open eppc 3306/tcp open mysql 3689/tcp open rendezvous 5900/tcp open vnc -- that is, no 993 in sight. Ideas? Thx!
    – Jim Miller
    Apr 19, 2011 at 22:23
  • Sorry for the lack of linebreaks above, but.... For what it's worth, those results are the same as what I'm getting when I nmap the server's external address from inside my network. I guess I got my DNS set up right.
    – Jim Miller
    Apr 19, 2011 at 22:24
  • Can you please specify the server type? What OS, Mail Server?
    – Vick Vega
    Oct 31, 2011 at 6:08

2 Answers 2

1

Are you sure you're forwarding the port from the router to your mail server correctly?

What kind of router you've got? Does it run Linux? If so, please post the output of iptables -nvL -t nat | grep 993. Also run tcpdump -nli ethN port 993 on the router, with ethN replaced with the outside NIC, and try to connect from the outside (not from linux2). If you see the packet coming in but not through, repeat with ethN replaced with the inside NIC. That's a sure way to determine if it is being routed correctly to your mail server.

If it isn't Linux, does it have a debug mode you can use to check something like the above?

1
  • The router is an old but mostly reliable Netopia 3346. No Linux in sight as far as I can tell. Good idea, though.
    – Jim Miller
    Apr 19, 2011 at 22:19
0

Run tcptraceroute from outside to see where the connection is getting blocked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .