We're using a pfSense firewall with a static public IP. TCP port 25 is forwarded to the mail server on the DMZ, according exactly to the directions here. This works great for most senders, and email is successfully forwarded to the internal mail server address.
However, some legitimate senders are being blocked on port 25 at the firewall rather than port-forwarded to the email server. I know pfSense blocks stuff with expired/incorrect state, etc even on legitimate ports, but this is regular traffic from a known email sender that's getting blocked. No entries exist for the sender in the state table. I've also looked at the pfSense port forward troubleshooting guide with no luck.
I've captured the traffic from the external sender in question; it's TCP port 25 with a SYN flag and good header checksum, definitely being blocked at the outside interface but doesn't seem to look different from packets that are being forwarded properly.
Here's a log entry for the blocked sender:
pf: 2. 858929 rule 34/0(match): block in on fxp0: (tos 0x0, ttl 117, id 41529, offset 0, flags [DF], proto TCP (6), length 48) [blocked-sender-ip].34056 > [internal-dmz-email-ip].25: S, cksum 0x68f8 (correct), 3080958461:3080958461(0) win 65535 <mss 1460,nop,nop,sackOK>
And one for a successful sender that looks pretty similar:
pf: 288804 rule 51/0(match): pass in on fxp0: (tos 0x0, ttl 111, id 34646, offset 0, flags [DF], proto TCP (6), length 48) [successful-sender-ip].2474 > [internal-dmz-email-ip].25: S, cksum 0xcf9c (correct), 1409725583:1409725583(0) win 65535 <mss 1460,nop,nop,sackOK>
Any idea what's going on here?