Help us enhance your Sophos Community experience. Share your thoughts in our Sophos Community survey.

Thread Info
  • State Verified Answer
  • Replies 12 replies
  • Subscribers 38 subscribers
  • Views 6358 views
  • Users 0 members are here
Options
Suggested

Sophos Firewall blocking outgoing IPv6 SMTP traffic

Nicolas Michaux

Hello,

I'm trying to configure SMTP on Sophos Firewall (SFOS 20.0.0 GA-Build222) : everything is running smoothly in IPv4, but Firewall is blocking outgoing IPv6 SMTP traffic : 

I tried to define all kinds of (IPv6) rules to allow this traffic without success : with or without 'Scan SMTP' enabled, from any zone to any zone, with or without linked NAT:

Is it possible to have an internal SMTP server in IPv4 relaying email to Sophos Firewall in IPv4 and Sophos Firewall sending emails to Internet over IPv6?

Thanks,

Nicolas



Edited TAGs
[edited by: emmosophos at 5:39 PM (GMT -8) on 26 Jan 2024]
Parents Reply Children
  • 0 in reply to Nicolas Michaux

    Hi,

    I did some more testing with the SMTP relay of Sophos XG.

    If you enable MTA mode on email settings and allow access to some zones from device access, you have configured a SMTP relay. Your firewall is listening on port 25 and accept emails from your network. However, it is unable to send them on Internet, even if you allow host based relaying. Every try to send an email finish with a timeout in the relay. The generated traffic from the relay is blocked by the internal firewall.

    You need to configure a rule to allow traffic from your internal zone to Internet and select "Scan SMTP" : without this rule, nothing is working as expected.

    When you have this rule (automatically generated when you switch MTA mode to on), you can send emails using Sophos XG as a relay. However, the relay is unable to send IPv6 traffic as the rule is IPv4 only. When you send an email to Gmail, Sophos receives it, check the MX of Gmail, find the DNS gmail-smtp-in.l.google.com ant try to connect to port 25 of 2a00:1450:400c:c1b::1a, which result in a timeout : 

    2024-02-06 19:05:16.438Z [30098] lN2ijY-sYARXZ-t9 H=gmail-smtp-in.l.google.com [2a00:1450:400c:c1b::1a]:25 Connection timed out

    If you configure a rule to allow traffic from your internal zone to Internet in IPv6, it isn't used as your email server is sending over IPv4!

    If I understand the design of the SMTP relay correctly, you can use it only in IPv4 OR IPv6, not both. If you connect to it in IPv4, you can send emails over IPv4 to Internet, if you connect to it over IPv6, you can send emails over IPv6 only on Internet. I can't understand why you need a rule to allow a SMTP relay to send emails over Internet, it should be an automatic allowed rule...

    For the incoming part of the relay, it works both in IPv4 and IPv6 if you create the right rule for each protocol.

    Regards,

    Nicolas

  • +1 in reply to Nicolas Michaux

    Hi,

    Today, I finally found the reason of all this mess.

    If you read carefully the log of the smtp daemon, you can see when it receives an email that it tries to match a firewall rule : 

    S='xxxxxxxx@example.com' R='xxxxx.yyyyyygmail.com' Subject='Test Gmail' Size='1816' Status='Mail has been queued for delivery.' src_ip='xxx.xxx.xxx.xxx' src_port=46148 user_id=0 user_grp_id=0 fw_id=0 src_zone_id=10

    If it match a rule (fw_id != 0), you'll be stuck in this rule and the firewall will not be able to send a IPv6 email.

    However, it it doesn't match a rule (fw_id=0), some magic happens and it will be able to deliver both IPv4 and IPv6 emails on Internet!

    I just had to delete my rule allowing SMTP from my email server AND add an exception to my dropping and logging rule to prevent SMTP to be intercepted.

    I hope it could help someone to understand this strange behavior.

    Regards,

    Nicolas

  • 0 in reply to Nicolas Michaux

    Hi,

    Just to be complete, if you follow this way, you won't be able to SNAT your SMTP trafic... You're in firewall rule id 0 and there isn't any (s)NAT applying to it.

    However, you can SNAT all your system-generated trafic with this console command : 

    set advanced-firewall sys-traffic-nat delete destination 0.0.0.0 netmask 0.0.0.0 interface wan snatip xxx.xxx.xxx.xxx

    For IPv6, as nothing is working by default, I just put my SMTP IPv6 address as main address on my wan interface.

    Anyway, everything is working as expected, as any IPv4/IPv6 SMTP relay!

    Cheers,

    Nicolas

  • 0 in reply to Nicolas Michaux

    Hi,

    I discovered today that I had to disable also incoming emails rules in firewall : recipient verification with callout wasn't working properly (timeout).

    Now, I'm running a real SMTP relay without any firewall rule and everything is working perfectly!

    Cheers,

    Nicolas

Unfiltered HTML