Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get a mail server to support IMAP-over-SSL services. Everything is fine inside my network: Clients can specify SSL and port 993 in their email client configuration, and mail gets through. However, it's not working from outside: Somewhere, the port is getting blocked.

Nmap tells me this for the internal network:

[root@linux2 ~]# nmap -p993
Starting Nmap 5.21 ( ) at 2011-04-18 09:54 PDT
Nmap scan report for (
Host is up (0.00022s latency).
993/tcp open  imaps
MAC Address: 00:1F:5B:35:F4:C8 (Apple)

And for the outside network:

[root@linux2 ~]# nmap -p993 
Starting Nmap 5.21 ( ) at 2011-04-18 09:54
PDT Nmap scan report for ( 
Host is up (0.0023s latency). 
993/tcp filtered imaps

So, somebody is doing some filtering; the question is who. My router's firewall has 993 open; I've also experimented with (briefly) disabling the router firewall altogether, but with no improvement. I've checked with my service provider (AT&T DSL), but they say they're not blocking it.

share|improve this question
Was that computer actually outside the internal network when you used nmap? Depending on your router (not sure if its always true) you cannot access your external IP/port from inside the network. Which is where split DNS comes in handy... – xeon Apr 18 '11 at 18:26
The latency on the nmap outputs makes me think Xeon is right and it's not truly outside the network. Can you nmap from far away? 'Filtered' usually means TCP wrappers or firewalling but could be indicative of the external IP issue Xeon mentioned. – Jonathan Ross Apr 18 '11 at 18:43
OK, I'm back from Starbucks with my laptop. The results are essentially what I've seen before: Starting Nmap 5.51 ( ) at 2011-04-19 14:57 PDT Nmap scan report for ( Host is up (0.20s latency). Not shown: 837 closed ports, 152 filtered ports PORT STATE SERVICE 25/tcp open smtp 53/tcp open domain 80/tcp open http 110/tcp open pop3 143/tcp open imap 548/tcp open afp 995/tcp open pop3s 3031/tcp open eppc 3306/tcp open mysql 3689/tcp open rendezvous 5900/tcp open vnc -- that is, no 993 in sight. Ideas? Thx! – Jim Miller Apr 19 '11 at 22:23
Sorry for the lack of linebreaks above, but.... For what it's worth, those results are the same as what I'm getting when I nmap the server's external address from inside my network. I guess I got my DNS set up right. – Jim Miller Apr 19 '11 at 22:24
Can you please specify the server type? What OS, Mail Server? – Vick Vega Oct 31 '11 at 6:08

Are you sure you're forwarding the port from the router to your mail server correctly?

What kind of router you've got? Does it run Linux? If so, please post the output of iptables -nvL -t nat | grep 993. Also run tcpdump -nli ethN port 993 on the router, with ethN replaced with the outside NIC, and try to connect from the outside (not from linux2). If you see the packet coming in but not through, repeat with ethN replaced with the inside NIC. That's a sure way to determine if it is being routed correctly to your mail server.

If it isn't Linux, does it have a debug mode you can use to check something like the above?

share|improve this answer
The router is an old but mostly reliable Netopia 3346. No Linux in sight as far as I can tell. Good idea, though. – Jim Miller Apr 19 '11 at 22:19

Run tcptraceroute from outside to see where the connection is getting blocked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.