0

As some of you might know, I am setting up an exchange server.

Now I ran into another problem:
I cannot connect to the SMTP service from outside the server!

The ports are opened in the gateway device (a ZyXEL USG50), Windows firewall is off.

I see the packets travekl through the ZyXEL firewall, and I can also see the packets with wireshark on the server, so I know they are getting all the way in to the server.

I also know it receives them, and sends out the reply - and this is where things go bad!

Analyzing with wireshark, I get these errors in the return packets:

Header checksum: 0x0000 [incorrect, should be 0x0779 (may be caused by "IP checksum offload"?)]
And:
Acknowledgment Number: 0x8e3337d1 [should be 0x00000000 because ACK flag is not set]

What the (sorry my French) hell is going on?
I really cant figure it out..

Thanks in advance.

4
  • According to wiki.wireshark.org/TCP_Checksum_Verification the checksum errors are presumably unrelated. I would guess that the ZyXEL is the problem. Can you run wireshark or something similar on the client from which you're connecting? If so, what does it show?
    – Jenny D
    Jul 4, 2012 at 9:27
  • Running Wireshark on the client PC doesnt give much of a result - all it shows is just the outgoing packets - and no incoming.
    – Frederik
    Jul 4, 2012 at 9:43
  • 1
    You have now proved that the packets leave the windows server to go to the ZyXEL, but they don't exit the ZyXEL to go to the client. I would take this as a huge flashing neon sign saying "look at the ZyXEL box"!
    – Jenny D
    Jul 4, 2012 at 10:03
  • You are right! Will take a deep, deep look into the logs of that ZyXEL box.
    – Frederik
    Jul 4, 2012 at 10:06

1 Answer 1

0

Allright, the problem was way simpler than it looked. It was simply a matter of the ISP blocking port 25.

So, if other people get the same issue, check with your ISP!

So, it actually wasn't the ZyXEL box at all. Spent nearly ½ hour with their support, going really, really deep into every logs available.

5
  • It also shows how important it is to give a full description of the setup... from your description, I got the impression that the client was sitting directly outside of the ZyXEL. It's very common indeed for ISPs to block port 25, to avoid having their customers' servers used as spam relays. The usual way to get around this is to put up an authenticated SMTP server on 587.
    – Jenny D
    Jul 4, 2012 at 12:19
  • Thanks for your reply. As far as I know, we only have 1 ISP here in Denmark that does block port 25. The server was already listening on port 587, but that wont work alone, as the server has to be able to receive mails too.
    – Frederik
    Jul 4, 2012 at 12:39
  • I used to work as a mail systems admin at an ISP, back when spam exploded from a few hundred mails per day to a few million... so I definitely see why ISPs filter it, and even back then (seven years ago) the practice was spreading. At this point, your ISP should be able to help you with forwarding mail, or give you an unfiltered connection. If not, change ISPs :-)
    – Jenny D
    Jul 4, 2012 at 13:01
  • It was just a single call away, and they gave me an unfiltered connection :) So problem is indeed solved now, just fixing the last small things, and it's good to go :)
    – Frederik
    Jul 4, 2012 at 13:02
  • Glad to hear it! Even after seven years since getting away from running a mail system, I can't help trying to fix any mail problems I come across...
    – Jenny D
    Jul 4, 2012 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .