ISP migration, SMTP issue can't find log entries to help

[Justin C]

Switching from one ISP to another. Currently I have two
connections to the internet from my network. Some of
the network clients use the new router/modem as their
default gateway, the mailserver (and a few others) use
the old router/modem.

The mailserver (exim4 on Debian stable) is accepting
SMTP connections on it's single LAN IP. If I telnet on
port 25 from a local client I connect OK; if I telnet
on port 25 from my home machine to our external IP with
the old ISP I connect OK; but if I try from my home
machine with the external IP given by the new ISP my
connection times out.

The router on the new ISP's connectin is a FireBrick
2700, there is a firewall rule in place for SMTP, and
I've set it to log connections that match that rule,
it's showing my connection attempts:

(IP addresses changed to protect the innocent!)
19 Apr 2013 09:40:50 strack-new P=6(3s/3600s) [PPPoE]x.x.x.163#17936-[Self]x.x.x.189#25 Map [LAN]10.0.0.x#25-[PPPoE]x.x.x.163#17936 [SMTP]

Here's what the rule-set looks like in XML if anyone is
intersted (IP addresses changed):
<rule-set name="Mappings"
target-interface="self"
no-match-action="continue"
comment="mappings for mailserver">
<rule name="SMTP"
target-port="25"
protocol="6"
set-target-ip="10.0.0.x"
action="accept"/>
</rule-set>
<rule-set target-interface="LAN"
no-match-action="reject"
comment="Default firewall rule - block incoming">
<rule source-interface="self"
comment="Allow from the FireBrick though"/>
</rule-set>

Is there logging I can turn on on my mailserver to see
if it's dropping the SMTP connection? I'm sure there
must be, but I don't know where it is.

Any other suggestions of where I might look to find why
this isn't working?

I'm grateful for any help you can give.


Justin.

--
Justin C, by the sea.

[Richard Kettlewell]

Justin C <justi...@purestblue.com> writes:

> Switching from one ISP to another. Currently I have two
> connections to the internet from my network. Some of
> the network clients use the new router/modem as their
> default gateway, the mailserver (and a few others) use
> the old router/modem.
>
> The mailserver (exim4 on Debian stable) is accepting
> SMTP connections on it's single LAN IP. If I telnet on
> port 25 from a local client I connect OK; if I telnet
> on port 25 from my home machine to our external IP with
> the old ISP I connect OK; but if I try from my home
> machine with the external IP given by the new ISP my
> connection times out.

What are the exact commands that succeed and fail and what is the
network configuration of the endpoints involved?

--
http://www.greenend.org.uk/rjk/

[Justin C]

I basically use telnet to instigate an SMTP transfer:

telnet 10.0.0.7 25

If there's an SMTP server on the end it responds and
you can send an email using the instructions here:
<URL: http://www.yuki-onna.co.uk/email/smtp.html>
I've used it many times.

From my machine at home if I use the telnet command
above with the external IP from the old ISP I get:
Trying [IP address]
Connected to [IP address]
Escape character is '^]'
220 [host.domain] ESMTP Exim 4.72 etc.

The same command with the external IP provided by the
new ISP:
Trying [IP address]
telnet: Unable to connect to remote host: Connection timed out.

Network configurations:
At end that issues the above commands I have a
192.168.x.x network of several clients. I ssh to my
Debian box there to run the above commands. Anything
else that would be useful to know here?

At SMTP server end there is also a 192.168.x.x
(different numbers in the network address though)
network of several clients. Both ISP connections this
end have modems and hardware firewall. We have
netgear ADSL modem and netgear FVS318 on the old ISP
setup. The new ISP has provided two Zyxel modems and
a FireBrick 2700, the modems are on seperate ADSL
lines, bonded at the ISP but over different carriers.
The connection with the new ISP is working fine for
web-browsing, I have yet to tackle things like VPN, I
want to get mail sorted first. Anything else that
would be useful to know?

[Richard Kettlewell]

The network configuration of the client, SMTP server and the routers and
a clear picture of how they are all tied together. On a modern Linux
box ‘ip addr show’ and ‘ip -0 route show’ should be a good start. On
Windows ‘ipconfig /all’ and ‘route print’. As for the routers, I
wouldn’t know.

--
http://www.greenend.org.uk/rjk/

[Nick Leverton]

In article <crg74a-...@zem.masonsmusic.co.uk>,

Justin C <justi...@purestblue.com> wrote:

> Switching from one ISP to another. Currently I have two
> connections to the internet from my network. Some of
> the network clients use the new router/modem as their
> default gateway, the mailserver (and a few others) use
> the old router/modem.
>
> The mailserver (exim4 on Debian stable) is accepting
> SMTP connections on it's single LAN IP. If I telnet on
> port 25 from a local client I connect OK; if I telnet
> on port 25 from my home machine to our external IP with
> the old ISP I connect OK; but if I try from my home
> machine with the external IP given by the new ISP my
> connection times out.

I hope I've understood your setup correctly. If the mail server's
default route is still set to the old router, then I imagine that's why
you can't make connections via the new router. Most firewalls these
days are stateful and need to see a a successful incoming SYN packet
(and the ensuing SYN/ACK then ACK) before they will pass a connection.
Your new router won't be passing the outgoing SYN/ACK, because it is
not seeing the SYN as that comes in via the old router.

Nick
--
"The Internet, a sort of ersatz counterfeit of real life"
-- Janet Street-Porter, BBC2, 19th March 1996

[Nick Leverton]

In article <kkrdqo$r18$1...@leverton.org>,

Err the last sentence should read:
>Your old router won't be passing the outgoing SYN/ACK, because it is
>not seeing the SYN as that comes in via the new router.

So easy to mess these things up :-)

[Justin C]

I'm not happy posting all those IP addresses to
usenet.

I did a bit more prodding about following your post
and I find that the default gateway for the smtp
server appears to be the problem. If I change it to
the new ISP gateway I can connect, but I get 554 SMTP
synchronisation error.

I believe it's a step in the right direction. Does
that shed any light on what else might be wrong?

[Nick Leverton]

In article <e5r74a-...@zem.masonsmusic.co.uk>,

Justin C <justi...@purestblue.com> wrote:
>
>I did a bit more prodding about following your post
>and I find that the default gateway for the smtp
>server appears to be the problem. If I change it to
>the new ISP gateway I can connect, but I get 554 SMTP
>synchronisation error.
>
>I believe it's a step in the right direction. Does
>that shed any light on what else might be wrong?

Yes, it pretty well confirms my suggestion (that no doubt overlapped
with your reply), at least so far as the lack of connection goes.

I don't know what causes the 554 SMTP synchronisation error though,
Google suggests it's an Exim protocol pickiness about HELO/EHLO ordering.
Are you typing EHLO before you get the 220 banner, perhaps ? Some MTA's
care (my homebrew one uses it as an excuse to dump the connection since
it's what fire-and-forget spammers tend to do).

[Justin C]

On 2013-04-19, Richard Kettlewell <r...@greenend.org.uk> wrote:

OK, problem resolved.

It was, as Nick suggested (or my interpretation of
it), exim wanting to reply over the default route
which wasn't where the incoming connection came from.

The SMTP error I had, well, I don't know exactly what
that was, all I can assume is a typo in what I sent.
Currently my mail server is accepting incoming SMTP
connections from either ISP.

Now to edit the DNS settings...

Thanks to you both, Richard and Nick, for helping me
discover and resolve this problem.