This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't sent outbound e-mail through UTM

Hi there. I will apologize in advance as I'm a bit of a noob, dealing with what is likely a relatively trivial problem. In any event, I'm running a Ubuntu 14.04 server with postfix and attempting to use the e-mail protection features of Sophos UTM (9.315). I've set up postfix as a satellite system pointing to the UTM on a separate box. I've gone through the standard Ubuntu tutorials on setting up postfix and all seems to be working on that end. I've also perused the forums and read the guides and watched the video.

Under routing, I've set my domain name and am using a static host list pointing to the server running postfix. I have verify recipients with callout.

Antivirus, Antispam and Data Protection are all the default settings.

Under Relaying, Upstream Host List and Authenticated Relay are all blank. I've included my server under "Host-based Relay".

Under Advanced, it's all just the default. Transparent routing is off.

Incoming e-mail seems to be working fine. However, all outbound mail just seems to get stuck in the SMTP Spool on the UTM. When I view a message on the spool, I see the following:

2015-08-06 12:08:07 ASPMX.L.GOOGLE.COM [173.194.197.27]:25 Connection timed out
2015-08-06 12:10:14 ALT1.ASPMX.L.GOOGLE.COM [64.233.190.27]:25 Connection timed out
2015-08-06 12:12:22 ALT2.ASPMX.L.GOOGLE.COM [74.125.24.27]:25 Connection timed out
2015-08-06 12:14:29 ASPMX2.GOOGLEMAIL.COM [173.194.206.27]:25 Connection timed out

The only thing I can think of is that it seems that the UTM is not using TLS (otherwise presumably the above would show 465 (or is it 587) rather than 25. However, according to the help file Sophos attempts to negotiate TLS automatically. I selected the WebAdmin cert for use with TLS.

So here's the dumb question - is outbound e-mail stuck because I need to use a CA issued cert for my domain in order for e-mail to be sent out? If that 's not the issue, any suggestions on how I might go about troubleshooting this further would be most appreciated.

This thread was automatically locked due to age.

0 dma0 over 9 years ago

I've now also tried obtaining and installing a PKCS#12 cert on the UTM and have uploaded the CA's intermediate and root certs in certificate authorities (as an aside, they're marked with a blue icon rather than a green one - not sure if that's relevant.

Anyway, same result with outbound e-mails with same message. The mail manager seems to continue trying to send through port 25, it seems.

Any advice would be most appreciated.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

You should have had no problem with the WebAdmin cert. Try #1 in Rulz. If that doesn't give you a lead, post the 5-to-40 lines from the SMTP log related to one of those attempts to deliver.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 dma0 over 9 years ago
Thanks very much Bob. Yes, sorry I forgot to mention - I did check all the logs to see if it might be the firewall, instruction protection or advanced threat blocking things, as that does not appear to be the case. The FW had also created a rule when first set up to allow for e-mail transmission.

I think I've figured out the cause though, but not necessarily the solution. Through some online research and running a few traceroutes, I've confirmed that my ISP blocks everything on port 25. From what I can tell, Sophos uses port 25 even when using TLS. I tried forcing the UTM to use TLS (which I would have thought would change the port) by specifying "Any" under Advanced/Require TLS Negotiation Hosts/Nets, but the UTM still seems to want to use port 25. Following are log entries after I made the foregoing change:

2015:08:07-15:36:07 styx exim-out[25559]: 2015-08-07 15:36:07 1ZNS0q-0005xV-9k ASPMX.L.GOOGLE.COM [74.125.207.26]:25 Connection timed out
2015:08:07-15:37:07 styx exim-out[25669]: 2015-08-07 15:37:07 1ZNnPw-0006fw-3e ASPMX.L.GOOGLE.COM [74.125.207.26]:25 Connection timed out
2015:08:07-15:38:14 styx exim-out[25559]: 2015-08-07 15:38:14 1ZNS0q-0005xV-9k ALT2.ASPMX.L.GOOGLE.COM [74.125.24.26]:25 Connection timed out
2015:08:07-15:39:14 styx exim-out[25669]: 2015-08-07 15:39:14 1ZNnPw-0006fw-3e ALT1.ASPMX.L.GOOGLE.COM [64.233.190.26]:25 Connection timed out
2015:08:07-15:40:21 styx exim-out[25559]: 2015-08-07 15:40:21 1ZNS0q-0005xV-9k ALT1.ASPMX.L.GOOGLE.COM [64.233.190.26]:25 Connection timed out
2015:08:07-15:40:21 styx exim-out[25558]: 2015-08-07 15:40:21 1ZNS0q-0005xV-9k == david@smellydog.ca R=dnslookup T=remote_smtp defer (110): Connection timed out

Is there any way to make the UTM use port 587 rather than port 25? I've confirmed through traceroutes that connectivity works through that port. However, in searching through the documentation and these forums, I haven't been able to find any way to require the UTM's SMTP proxy to use port 587.

Any suggestions on that front would be most appreciated.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

If this is a home-use situation, check to see if your ISP has a smart host you can use. If not, google site:astaro.org "smtp.gmail.com", limiting results to the past year to see how member BarryG reported being able to use that to relay off of.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 dma0 over 9 years ago in reply to BAlfson

Thanks very much Bob. I was hoping to avoid the need to use a smarthost.
Cancel
Vote Up 0 Vote Down

Cancel