SOPHOS XG 19.5 SMTP to internal server (NOT DMZ)

Question

Hey Guys, 
 New to Sophos XG have read a bit of documentation most of which references, External to DMZ(internal) connection. Not External to Internal Network. 
 I am familiar with the old Microsoft Firewall where you would create a publishing rule for an exchange server. 
 I followed the document "Protect Internal mail server in legacy mode" Mar 11 2022..(However I was unable to send or receive email). 
 I also tried MTA mode. 
 No matter what I did at best I could only telnet to internal interface of the firewall on port 25. I could not do this with the external interface of the firewall. 
 Internal Active Directory email works fine internally. But email is not getting out, nor is email being received. 
 I have been using this tool to test, no response from the firewall. 
 Network Tools: DNS,IP,Email (mxtoolbox.com) 
 All I've been getting is: 
 Connecting to 1XX.1XX.2XX.2XX 2/2/2023 2:55:38 AM Connection attempt #1 - Unable to connect after 15 seconds. [15.04 sec] LookupServer 15233ms 
 I've also used. DNS Checker - DNS Check Propagation Tool 
 My mx record is correct and dns is working fine. 
 mydomain.com (Is the external reference) 
 Internally it is subdomain.mydomain.com 
 The Exchange server accepts mail from mydomain.com and subdomain.mydomain.com (all email however is presented at mydomain.com) 
 Any help would be greatly appreciated. Is there are document out there or a video that can assist me? 
 
 Thanks :-)

emmosophos · Accepted Answer

Hello there, 
 Is your Sophos Firewall the edge router? Do you see the Sophos Firewall's Public IP in the WAN interface? 
 If not, you would need to create also a DNAT rule in your upstream device to allow the traffic to arrive at the Sophos Firewall, also, make sure Port 25 is open by your ISP. 
 You can check by doing a TCPdump on the Firewall on Port 25, listening on the WAN port, and then trying to telnet to it from outside your network on Port 25 
 E.G 
 # tcpdump -eni Port2 port 25 
 (Substitute Port2 for the WAN port of your Sophos Firewall) 
 An upstream device blocks traffic if you don't see traffic arriving. 
 Regards,

Christopher Kurdian · Answer

Thankyou very much for your assistance. Very appreciated. It was ISP blocking the port which was the issue. I called them, they have unblocked all ports and now everything is working fine. :-)

SOPHOS XG 19.5 SMTP to internal server (NOT DMZ)

Top Replies