telnet mydomain.tld 25 tells me "connection refused"

that's the extent of my network hax0r skillz.

how can i tell if it's my network i'm on or the server itself?


The tool you're looking for is "tcptraceroute". Specify the destination port, and look for at what point in the trace it fails.

  • 2
    If you dont have tcptraceroute, on a modern traceroute, tcptraceroute is equivalent to traceroute -T – camh Aug 21 '10 at 9:31
  • 1
    Slick! You can even specify a port with "-p", so it'd be "tcptraceroute -Tp 25 mydomain.tld" in this case. Thanks for the pointer. – BMDan Aug 24 '10 at 10:15

Does it show up in netstat as listening on that server? Can you telnet from that server to itself on port 25? If so, the server is listening on port 25.

Then try from another machine in the same network. If that doesn't work, then a firewall is most likely to blame, and it's on the SMTP server. I'm assuming it's iptables or the Windows firewall. Check here for disabling it on Windows, or use the GUI.

If you can't reach it from outside your network, it may either be a firewall issue (again) or a NAT issue. If you have a private address on your server (like 192.168.x.x, 172.16-32.x.x, or 10.x.x.x), then you'll need to forward port 25 from your gateway to the server's internal IP.

This should give you a good start. Let us know!

  • +1 Does it show up in netstat? - no - now what? – n611x007 Jul 2 '15 at 17:18
  • if I convert my port number to hex, it does show up in the /proc/net/tcp file – n611x007 Jul 2 '15 at 17:26

Probably the simplest way to check is go to a computer outside the network and telnet/nmap to the port.

http://www.canyouseeme.org/ offers you to select your port number and they test it from online.

Good luck!

  • nice tool. but that tests incoming filtering, not outgoing. – John Bachir Aug 21 '10 at 14:40

telnet port 25 to any other server?

  • yep, i thought of that :) but didn't know any smtp servers off the top of my head… i theoretically could have found one easily enough but i was interested in a more general solution for future reference anyway (as was provided in the response i marked as the answer). – John Bachir Aug 21 '10 at 14:39

Take DNS out of the equation for a minute. Can you telnet to port 25 of the ip address of your email server?


use nmap to check if the host port is open. If it is, you 'd better change it to ssh :> Unfortunately telnet is dead and should be used only for backwards compatibility (Sends everything plaintext)

But in your case, depending on what nmap returns, either the port isn't open or it's open but access is restricted only to certain group and not to anyone.

  • He's using telnet to port 25, not to the telnet login port. – Bill Weiss Aug 21 '10 at 1:32
  • 1
    ok ... my mistake ... but it's still the same. telnet to 25 usually means fake mail. And usually it's blocked. and yes .. you can still use nmap to find out if the port is open ... and yes if it's open you are blocked. – Nikolaidis Fotis Aug 21 '10 at 1:48
  • Bill is right, but Nikolaidis I didn't realize nmap reports if something is filtering in between, that's great! although i've always been confused about what filtered vs. closed means, because shouldn't it list 1000+ ports as being closed? – John Bachir Aug 21 '10 at 14:46
  • Becareful with nmap from residential ISP's, I've had at least one case where they shut me down due to a suspected virus or something. I had to convince them my linux machines were fine, and I couldn't run Norton AV or any AV they suggested on them, but I was Certain I was clean. – Jason Aug 21 '10 at 21:44
  • John: "filtered" means that no response was received from the server. "Closed" means a TCP RST was received. The former usually indicates that a firewall has blocked the connection (as they rarely issue RSTs for their "deny" rules), while the latter typically indicates that there really is nothing listening on that port, albeit with the caveat that, with a bit of effort, a crafty net.admin can completely mess up that set of assumptions. – BMDan Aug 24 '10 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.