0

I have been seeing more of these types of bounceback messages (IP address changed for example):

mail.test.com #550-Your message was rejected by this user and was not delivered. 550-Reason: Your IP address [1.1.1.2] appears not to be an email server. 550-Protection provided by: MagicMail version 1.3.5 (http://magicmail.linuxmagic.com) 550-For more information, please visit the URL: 550-http://www.linuxmagic.com/best_practices/check_dynamic_reverse_dns.html 550-or contact your ISP or mail server operator. 550 ae9e5e74-0ad7-11e3-b831-0050569008a5 ##

We have all of the DNS records set up for our e-mail servers and smtp outbound relay. Our MX record actually points back to our Barracuda Spam/Virus Filter in front of our Exchange server. The IP address that the message is referring to is the IP address assigned to our WAN on our Firewall/Nat device. Our default gateway address in this example would then be 1.1.1.1

What do I have to set up so that these messages are delivered? Do I set up a fake MX record pointing to the default gateway? Add another A & PTR record pointing to the WAN IP address? Is there something in our internal configuration that could be incorrect? No records are set up for the gateway address now, just the assigned IP addresses for each of the outbound services. All servers are Windows based. Primary e-mail server is Exchange 2007.

  • Is that gateway acting as a NAT boundary for your devices? – MDMarra Aug 22 '13 at 12:49
  • I just updated the question. The IP address in the bounceback is the WAN address assigned to our Firewall/NAT device (1.1.1.2). Our default gateway would then be 1.1.1.1 – NinjaBomb Aug 22 '13 at 13:00
0

You will need to configure your gateway/router/NAT device to source-NAT (SNAT) your Exchange server's internal IP address to the IP of your Barracuda appliance.

An alternative is to configure your Exchange server to relay mail via the Barracuda unit by adding a Send Connector: http://technet.microsoft.com/en-us/library/aa998814(v=exchg.80).aspx

  • 1
    We have the NAT rules set up already and everything works for the most part. Basically, are you recommending that we need set some sort of rule that forces the e-mail being sent out to leave from a specific IP address in the range we own and not the IP address of our WAN? Searching my device Manufacturer + Source NAT doesn't give me anything useful. Searching only Source NAT doesn't seem to provide any good information either. – NinjaBomb Aug 22 '13 at 20:01
  • Yes, that is what you will need to do. If you post you router make and model, I'll see what I can find. If your router really isn't capable of SNAT, you'll need to use the alternative and effectively funnel your emails via your Barracuda unit. – Craig Watson Aug 23 '13 at 7:03
  • Ok, thanks. It is a Sonicwall TZ 210. – NinjaBomb Aug 24 '13 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.