Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

telnet mydomain.tld 25 tells me "connection refused"

that's the extent of my network hax0r skillz.

how can i tell if it's my network i'm on or the server itself?

share|improve this question
up vote 5 down vote accepted

The tool you're looking for is "tcptraceroute". Specify the destination port, and look for at what point in the trace it fails.

share|improve this answer
If you dont have tcptraceroute, on a modern traceroute, tcptraceroute is equivalent to traceroute -T – camh Aug 21 '10 at 9:31
Slick! You can even specify a port with "-p", so it'd be "tcptraceroute -Tp 25 mydomain.tld" in this case. Thanks for the pointer. – BMDan Aug 24 '10 at 10:15

Does it show up in netstat as listening on that server? Can you telnet from that server to itself on port 25? If so, the server is listening on port 25.

Then try from another machine in the same network. If that doesn't work, then a firewall is most likely to blame, and it's on the SMTP server. I'm assuming it's iptables or the Windows firewall. Check here for disabling it on Windows, or use the GUI.

If you can't reach it from outside your network, it may either be a firewall issue (again) or a NAT issue. If you have a private address on your server (like 192.168.x.x, 172.16-32.x.x, or 10.x.x.x), then you'll need to forward port 25 from your gateway to the server's internal IP.

This should give you a good start. Let us know!

share|improve this answer
+1 Does it show up in netstat? - no - now what? – n611x007 Jul 2 '15 at 17:18
if I convert my port number to hex, it does show up in the /proc/net/tcp file – n611x007 Jul 2 '15 at 17:26

Probably the simplest way to check is go to a computer outside the network and telnet/nmap to the port. offers you to select your port number and they test it from online.

Good luck!

share|improve this answer
nice tool. but that tests incoming filtering, not outgoing. – John Bachir Aug 21 '10 at 14:40

telnet port 25 to any other server?

share|improve this answer
yep, i thought of that :) but didn't know any smtp servers off the top of my head… i theoretically could have found one easily enough but i was interested in a more general solution for future reference anyway (as was provided in the response i marked as the answer). – John Bachir Aug 21 '10 at 14:39

Take DNS out of the equation for a minute. Can you telnet to port 25 of the ip address of your email server?

share|improve this answer

use nmap to check if the host port is open. If it is, you 'd better change it to ssh :> Unfortunately telnet is dead and should be used only for backwards compatibility (Sends everything plaintext)

But in your case, depending on what nmap returns, either the port isn't open or it's open but access is restricted only to certain group and not to anyone.

share|improve this answer
He's using telnet to port 25, not to the telnet login port. – Bill Weiss Aug 21 '10 at 1:32
ok ... my mistake ... but it's still the same. telnet to 25 usually means fake mail. And usually it's blocked. and yes .. you can still use nmap to find out if the port is open ... and yes if it's open you are blocked. – Nikolaidis Fotis Aug 21 '10 at 1:48
Bill is right, but Nikolaidis I didn't realize nmap reports if something is filtering in between, that's great! although i've always been confused about what filtered vs. closed means, because shouldn't it list 1000+ ports as being closed? – John Bachir Aug 21 '10 at 14:46
Becareful with nmap from residential ISP's, I've had at least one case where they shut me down due to a suspected virus or something. I had to convince them my linux machines were fine, and I couldn't run Norton AV or any AV they suggested on them, but I was Certain I was clean. – Jason Aug 21 '10 at 21:44
John: "filtered" means that no response was received from the server. "Closed" means a TCP RST was received. The former usually indicates that a firewall has blocked the connection (as they rarely issue RSTs for their "deny" rules), while the latter typically indicates that there really is nothing listening on that port, albeit with the caveat that, with a bit of effort, a crafty net.admin can completely mess up that set of assumptions. – BMDan Aug 24 '10 at 10:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.