Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a juniper ssg 5 as my firewall

These are a couple of things I have tried:

I used the wizard to create route based vpn

I've tried creating multiple policies based on the different services that seem appropriate, starting with pop3,imap,ms-exchange and anything else that seemed close

Almost everything that I try seems to have no effect, using mxtoolbox on my public ip shows all ports are closed. I suppose my ISP's router could also be blocking the traffic, but I would have to call them to have them reconfigure it.

I am able to send mail out, but replies seem lost, no error msgs are generated on either side.

We were assigned one static IP and 5 public IP's, according to ATT, nothing is blocked whatsoever port-wise.

At this point, I have tried creating a virtual IP that is the same as the static IP and forwarded smtp traffic through port 25 to the internal IP of the mail server. I have also added policies to allow traffic from any IP to pass through both the public IP and the internal IP for mail (keep in mind the "public" IP is different then the "static" IP.

What also confuses me is this: since I've added this virtual IP (once again, the same as the static IP), forwarded it to the internal mail server IP AND selected to send the traffic through port 25, do I need to mess with the NAT settings on the policies at all?

share|improve this question
Lets go back to basics for a moment (you say you tried stuff "that seemed close" so I assume you are somewhat of a novice). Do you have MX records? All you should need to open is SMTP (port 25) on your firewall. – Ben Pilbrow May 9 '11 at 20:32
Do you mind supplying the domain in question so we can do a lookup? – DanBig May 11 '11 at 12:05

There is a very big chance that your ISP or your firewall is blocking port 25. You should call your ISP and start with them and ask.

If they confirm that it is open, you could also telnet into your servers IP address from an outside machine and test this as well. Then you will need to open the port, VPN settings should have no effect on this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.