0

I am fully aware that the Azure platform has new measures in place to prevent outgoing SMTP (port 25) usage unless you explicitly ask for this restriction be lifted and that sendgrid is an option however my question is if it was possible for one to setup an OpenVPN or similar connection to their private network and then have the relevant application on the Azure VM send email over port 25? Would it be possible to force route this sort of traffic (SMTP) over the VPN in order for it to be processed at the other side or is inspection done at a lower level which will still prevent even using a VPN to send SMTP traffic?

1 Answer 1

0

Yes. What you are describing is possible from resources on the VNET connecting to a server on the other side of the VPN via port 25.

Be advised that not all services that are connected to the VNET will be able to do this (App Service with VNET integration won’t be able to as all outbound traffic other than to Service Endpoints/Private Link will be via the Internet).

6
  • I have installed and setup OpenVPN to the remote network and confirmed HTTP traffic is indeed now originating from the remote IP address (routed via the VPN) however SMTP still seems to fail. Are there specific entries I need to add in the NSG? Do I need to do this (docs.microsoft.com/en-us/azure/vpn-gateway/…) in order for it to work?
    – dqnet
    Sep 1, 2020 at 11:19
  • If you’re not using Azure VPN and are running your own, it’ll still work. Azure has no idea what’s traversing that VPN. You’ll still need to ensure that your SMTP traffic is being sent through the VPN though. What’s the source of the SMTP traffic?
    – Greg W
    Sep 1, 2020 at 11:22
  • The source is micro store mail server. So basically two MX records, one is pointing to Azure VM one on the full email platform. If the primary platform goes down the Azure MX takes over. It stores the mail until the second MX is backup and forwards the mail there. So SMTP is coming into Azure fine however when we test the setup mail just queues up and doesn't seem to transverse the VPN down to the other side. I can try telnetting a little later today to see if manual sends work but are there any specific NSG rules required? Thanks.
    – dqnet
    Sep 1, 2020 at 11:32
  • The default rules would allow all outbound traffic. You can always perform a connectivity trace to see what, if anything, is blocking the connection. The NSG rules aren’t used to implement the SMTP blocking Azure applies to the subscription level by default.
    – Greg W
    Sep 1, 2020 at 11:35
  • Let me give this whirl and get back to you - Thanks.
    – dqnet
    Sep 2, 2020 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .