Exim Port 25 Connection Problem.

[kaspersetz]

I am expierencing some wierdness with one of my client's mail servers not being able to send mail to accounts on my cpanel server. This problem started a couple of days ago. Both sides, myself included, claim "nothing has changed." My client is not being very cooperative in this process. I am sure you can all imagine when someone automatically blames you. Enough of the rant.

So to test things I logged into his machine and I attempted to telent to port 25 on my machine. The connection hangs for a long time and then drops.

[[email protected] ~]$ telnet 66.98.xxx.74 25
Trying 66.98.xxx.74...
telnet: connect to address 66.98.xxx.74: Connection timed out
telnet: Unable to connect to remote host: Connection timed out
[[email protected] ~]$

When he telnets to 207.44.xxx.58 no problem:

[[email protected] ~]$ telnet 207.44.xxx.58 25
Trying 207.44.xxx.58...
Connected to 207.44.xxx.58 (207.44.xxx.58).
Escape character is '^]'.
220 207.44.xxx.58 ESMTP -NO UCE-

However, if I telent to that port on my cpanel machine from other machines I can connect no problem. I get the normal messages from the mail server. The wierdest part is that I turned my Exim logging on to +all and I don't even see the connection attempt from thier machine. If I telnet to the port from other machines, I see the connection attempt in exim_mainlog.

He is able to ping my machine. I am not really sure how to proceed. Is there a black list that might be droping all the packets from his machine on port 25? He can surf the sites on my machine.

Any help would be greatly appreciated.
Hans

 

[sparek-3]

I assume that 66.98.xxx.74 refers to your CPanel server. What does 207.44.xxx.58 refer to?

I suspect that the user's ISP is blocking remote SMTP servers. This is becoming increasingly common and really it does not cause any problems. If this is the case, then the user will have to use their ISP's outgoing mail server to send out mail. They can still send mail out as From: [email protected], but the actual message will be sent out through their ISP's outgoing mail server. What outgoing mail server you use has no bearing as to what e-mail address you can send a message from.

If 207.44.xxx.58 refers to the user's ISP outgoing mail server, then this would explain everything.

 

[Lyttek]

You can also run a second copy of exim on another port, which gets around ISP port 25 blocks.

 

[kaspersetz]

more details.

My customer's machine is a windows exhange server that is connected to a t1 and a dsl bound by a fatpipe device. I don't think his ISP is droping port 25 traffic. They had been able to send me mail as of Monday, the cpanel box started rejecting mail from them and now they can not even connect to the cpanel box. Something changed and I am trying to figure out if the Cpanel box is blocking them on port 25. I am able to connect to my Cpanel box on port 25 from other machines.

66.98.xxx.74 is the cpanel box that they can not connect to.

207.44.xxx.58 is a Freebsd server I manage, I provided both to demonstrate the fact that they, the windows exchange server, can connect to some boxes on port 25 but not the cpanel box.

So to clarify, I was on the command line of the Windows box trying to connect to the Cpanel's port 25.

He can ping the cpanel box (66.98.xxx.74) and he can surf sites on the cpanel box. This problem seems to be limited to port 25 traffic.

Where would I look on my cpanel server to see if his IP address or network is being filtered?

 

[sparek-3]

Do you know the external IP of the exchange server that is trying to connect to 66.98.xxx.74?

If you know this IP, then from the command line on the CPanel server (66.98.xxx.74) run:

iptables -L -n | grep <ip>

This will check to see if that IP is blocked on your server.

I don't know what would be clocking the IP, but its possible that your server may be blocking the entire class C of that network, so if nothing comes up, check it again, but remove the last octet.

For example, if the connecting IP was 24.134.193.34, then this IP with the last octet removed would be 24.133.193.

If no block shows up on your server, then I would make sure the user does not have a firewall in place that may be blocking access to 66.98.xxx.74 from their machine. If all of these fail, then I would contact your upstream provider, perhaps a router somewhere along the client's path to the server is blocking traffic from this IP to your server on port 25.

 

[kaspersetz]

Mysterious!

Well, all that fretting was for naught. The mail starting working again. I didn't make any changes and my customer says he didn't either.

Gotta love the internet.
HCK