As some of you might know, I am setting up an exchange server.

Now I ran into another problem:
I cannot connect to the SMTP service from outside the server!

The ports are opened in the gateway device (a ZyXEL USG50), Windows firewall is off.

I see the packets travekl through the ZyXEL firewall, and I can also see the packets with wireshark on the server, so I know they are getting all the way in to the server.

I also know it receives them, and sends out the reply - and this is where things go bad!

Analyzing with wireshark, I get these errors in the return packets:

Header checksum: 0x0000 [incorrect, should be 0x0779 (may be caused by "IP checksum offload"?)]
Acknowledgment Number: 0x8e3337d1 [should be 0x00000000 because ACK flag is not set]

What the (sorry my French) hell is going on?
I really cant figure it out..

Thanks in advance.

  • According to wiki.wireshark.org/TCP_Checksum_Verification the checksum errors are presumably unrelated. I would guess that the ZyXEL is the problem. Can you run wireshark or something similar on the client from which you're connecting? If so, what does it show? – Jenny D Jul 4 '12 at 9:27
  • Running Wireshark on the client PC doesnt give much of a result - all it shows is just the outgoing packets - and no incoming. – Frederik Nielsen Jul 4 '12 at 9:43
  • 1
    You have now proved that the packets leave the windows server to go to the ZyXEL, but they don't exit the ZyXEL to go to the client. I would take this as a huge flashing neon sign saying "look at the ZyXEL box"! – Jenny D Jul 4 '12 at 10:03
  • You are right! Will take a deep, deep look into the logs of that ZyXEL box. – Frederik Nielsen Jul 4 '12 at 10:06

Allright, the problem was way simpler than it looked. It was simply a matter of the ISP blocking port 25.

So, if other people get the same issue, check with your ISP!

So, it actually wasn't the ZyXEL box at all. Spent nearly ½ hour with their support, going really, really deep into every logs available.

  • It also shows how important it is to give a full description of the setup... from your description, I got the impression that the client was sitting directly outside of the ZyXEL. It's very common indeed for ISPs to block port 25, to avoid having their customers' servers used as spam relays. The usual way to get around this is to put up an authenticated SMTP server on 587. – Jenny D Jul 4 '12 at 12:19
  • Thanks for your reply. As far as I know, we only have 1 ISP here in Denmark that does block port 25. The server was already listening on port 587, but that wont work alone, as the server has to be able to receive mails too. – Frederik Nielsen Jul 4 '12 at 12:39
  • I used to work as a mail systems admin at an ISP, back when spam exploded from a few hundred mails per day to a few million... so I definitely see why ISPs filter it, and even back then (seven years ago) the practice was spreading. At this point, your ISP should be able to help you with forwarding mail, or give you an unfiltered connection. If not, change ISPs :-) – Jenny D Jul 4 '12 at 13:01
  • It was just a single call away, and they gave me an unfiltered connection :) So problem is indeed solved now, just fixing the last small things, and it's good to go :) – Frederik Nielsen Jul 4 '12 at 13:02
  • Glad to hear it! Even after seven years since getting away from running a mail system, I can't help trying to fix any mail problems I come across... – Jenny D Jul 4 '12 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.