Re: cannot get mail from outside to my smtp server

2 msg	Remote backup Postfix server
7 msg	chose interface for outgoing mail
2 msg	Illegal address syntax ... in MAIL command: <...
1 msg	Mail Infrastructure and Zertificon
1 msg	sasl password
6 msg	postfix TLS (configuration/user) problem
7 msg	Virtual Alias Domain
3 msg	copy of email
2 msg	DNS Caching?
5 msg	Using mysql for mynetworks
5 msg	Blocking e-mail from a domain, to a particular ...
5 msg	prevent open relay

cannot get mail from outside to my smtp server
\ test test evm (12 Mar 2008)
. \ Evan Platt (12 Mar 2008)
. \ mouss (12 Mar 2008)
. . \ test test evm (12 Mar 2008)
. . . \ mouss (12 Mar 2008)
. \ Evan Platt (12 Mar 2008)
. . \ test test evm (12 Mar 2008)
. . . \ Randy Ramsdell (12 Mar 2008)
. . . . \ test test evm (12 Mar 2008)
. \ (Lou Picciano) (12 Mar 2008)
. . \ mouss (12 Mar 2008)
. . \ Matt Rude (12 Mar 2008)
. \ (Lou Picciano) (12 Mar 2008)
. \ (Lou Picciano) (12 Mar 2008)
. . \ mouss (12 Mar 2008)

6 msg	Error connecting Postfix to LDAP
5 msg	Config ok for TLS/SASL/Client Cert via port 587?
7 msg	mail flow architecture
3 msg	virtual forward + deliver
1 msg	Re: RESOLVED: Using Canonical Maps as an Overri...
14 msg	dual mail server
3 msg	how to specify different outgoing IP

Subject:	Re: cannot get mail from outside to my smtp server
Group:	Postfix-users
From:	mouss
Date:	12 Mar 2008

Lou Picciano wrote:
> -------------- Original message ----------------------
> From: mouss <mouss>
>
>> Lou Picciano wrote:
>>
>>> We are having a similar problem:
>>>
>>> From 'the outside', ie, with all traffic directed through external DNSs, we
>>>
>> can telnet to 'mail.wonderland.com' and negotiate a session normally.
>>
>>>
>>>
>> what session do you negociate? if it's not an smtp session, then it
>> irrelevant. if it's an smtp session, you need to make sure you are
>> talking to your own postfix. if so, you'll see logs.
>>
>>> However, cannot get any response from postfix when mail is sent from an
>>>
>> external source to 'alice' ... No logging, nothing!
>>
>>>
>>>
>> no logs, no postfix.
>>
>>> The Postfix server is on a DMZ host, and all traffic is directed to it.
>>>
>>> If we are successfully telnet'ing to the server, the necessary port is open,
>>>
>> right?
>>
>>>
>>>
>> telnet is a general program (do not confuse with the telnet protocol,
>> which uses port 23). so it all depends on what you mean by telnet to the
>> server.
>>
>
> Sorry - I was unclear. I am successfully telnetting to port 25, with the domain name resolved by an external (Comcast) DNS server:
>
> $ telnet mail.wonderland.com 25
> Trying <resolves to our external IP address>...
> Connected to mail.wonderland.com.
> Escape character is '^]'.
> 220 mail.wonderland.com ESMTP Postfix
> ^]
> telnet> exit
>
> The session above does produce a postfix log, as expected.
>
>
>> if your server is on a comcast IP, chances are that comcast blocks
>> access to port 25. try port 587 (after enabling the submission port in
>> master.cf and restarting postfix) to be sure.
>>
>
> We've been seeing that various ISPs have been blocking port 25, so wanted to test this first.
> Again, is the logic correct: That if we're telnetting to port 25, this port must be open?
> Or is it only available because we are coming into the server from elsewhere in the Comcast namespace?
>

they may block port 25 from oustide of their network. this is somewhat
bogus as they should block
- outbound port 25 (to prevent zombies sending spam)
- inbound _from_ port 25 (to prevent "split routing" spam)

they do not need to block inbound 25 except for commercial reasons.

if the IP is 68.37.219.231, then it is blocked (tested from 3 different
networks).
> I think we have every firewall option turned off to test this, as well...
>

you can try a dnsstuff domain report. it will test the connection to
your server from oustide of your network.