Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been struggling with an issue between two mail servers behind my Sonicwall NSA 2400. Both servers interact with the outside world just fine, but they cannot successfully send e-mail to each other. Here's the setup:

There are three interfaces on the NSA 2400 at play here: X0, X2, and X4.

SERVER1 (my email server)
Interface: X0
Internal IP: 192.168.1.5 (255.255.255.0)
Public IP: 10.9.8.7 (255.255.255.240)

SERVER2 (not my email server, but connected to same firewall on different interface)
Interface: X2
Internal IP: 192.168.2.6 (255.255.255.0)
Public IP: 10.9.8.4 (255.255.255.240)

Both the X0 and the X2 interface are in the LAN zone (to use Sonicwall terminology), but different subnets. The external IPs of both machines are in teh same subnet in the WAN zone on interface X4.

The firewall is set to allow traffic from LAN -> WAN, WAN -> LAN, LAN -> LAN, and WAN -> WAN on port 25 in both directions between the two servers. Each server is attempting to locate each other using the public IP. The public IPs NAT to the respective internal IPs for both inbound and outbound traffic and I know that it's done correctly since our mail servers are having no issues with any other mail servers.

I've done packet traces and I seem to be getting a TCP handshake error. I can't really figure out much beyond that.

share|improve this question
    
10.9.8.7 and 10.9.8.4 are not public (routable) ip addresses. –  joeqwerty Mar 11 '11 at 17:34

1 Answer 1

up vote 1 down vote accepted

If you don't have NAT rules specifically handling traffic from internal subnets (generally called Firewalled Subnets) to external IPs of those internal machines, you need them. In my config they go something like this:

Original Source: Firewalled Subnets  
Translated Source: [public IP of server]   
Original Destination: [public IP of server]   
Translated Destination: [private IP of server]
share|improve this answer
    
hwilbanks, I worked with Sonicwall tech support and you're correct, but there's another piece to it. In the LAN to LAN rules, I have to (counterintuitively) add a rule that says allow SMTP from SERVER1's internal IP to SERVER2's external IP (even though SERVER2's external IP is a WAN network object). Then obviously I have to create the opposite rule from SERVER2 to SERVER1. –  pk. Mar 11 '11 at 21:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.