While PFSense is inline (transparent mode)
any mail traffic to an exim server has issues receiving the handshake.
(please see tcpdump below)
interesting as everything is in DMZ - firewall set to allow all traffic.
Now - when I remove the transparent pfsense and just let it run -
works like a charm
Any ideas ?
Thanks in advance,
(I can open a ticket since we have support contract if needed)
[key-pub823947892vstp ~]# tcpdump -lnXx -s 1524 port 25 and host
216.156.x.x
tcpdu.mp: verbose output suppressed, use -v or -vv for full protocol
decode
listening on eth0, link-type EN10MB (Ethernet), capture size 1524 bytes
01:44:40.913511 IP 216.156.x.x.33318 > 216.112.x.x .smtp: S
1273441884:1273441884(0) win 5840 <mss 1460,sackOK,timestamp 1673283
0,nop,wscale 0>
0x0000: 0012 3f47 b619 0030 48d4 0528 0800 4510 ..?G...0H..(..E.
0x0010: 003c a61f 4000 4006 98c2 d870 241f d870 .<....@.@....p$..p
0x0020: 26ca 8226 0019 4be7 2e5c 0000 0000 a002 &..&..K..\......
0x0030: 16d0 b08d 0000 0204 05b4 0402 080a 0019 ................
0x0040: 8843 0000 0000 0103 0300 .C........
01:44:40.913597 IP 216.112.x.x .smtp > 216.156.x.x.33318: S
91768326:91768326(0) ack 1273441885 win 5792 <mss
1460,sackOK,timestamp 1298911134 1673283,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 8226 0578 4606 4be7 2e5d a012 $....&.xF.K..]..
0x0030: 16a0 4822 0000 0204 05b4 0402 080a 4d6b ..H"..........Mk
0x0040: cf9e 0019 8843 0103 0302 .....C....
01:44:40.973453 IP 216.112.x.x .smtp > 216.156.x.x.33307: S
41505924:41505924(0) ack 1218119892 win 5792 <mss
1460,sackOK,timestamp 1298911194 1668634,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 821b 0279 5484 489b 08d4 a012 $......yT.H.....
0x0030: 16a0 7770 0000 0204 05b4 0402 080a 4d6b ..wp..........Mk
0x0040: cfda 0019 761a 0103 0302 ....v.....
01:44:42.973050 IP 216.112.x.x .smtp > 216.156.x.x.33308: S
49280137:49280137(0) ack 1226788504 win 5792 <mss
1460,sackOK,timestamp 1298913194 1668842,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 821c 02ef f489 491f 4e98 a012 $.........I.N...
0x0030: 16a0 880b 0000 0204 05b4 0402 080a 4d6b ..............Mk
0x0040: d7aa 0019 76ea 0103 0302 ....v.....
01:44:43.143144 IP 216.156.x.x.33319 > 216.112.x.x .smtp: S
1275944168:1275944168(0) win 5840 <mss 1460,sackOK,timestamp 1673506
0,nop,wscale 0>
0x0000: 0012 3f47 b619 0030 48d4 0528 0800 4510 ..?G...0H..(..E.
0x0010: 003c d5ca 4000 4006 6917 d870 241f d870 .<....@.@.i..p$..p
0x0020: 26ca 8227 0019 4c0d 5ce8 0000 0000 a002 &..'..L.\.......
0x0030: 16d0 80fb 0000 0204 05b4 0402 080a 0019 ................
0x0040: 8922 0000 0000 0103 0300 ."........
01:44:43.143171 IP 216.112.x.x .smtp > 216.156.x.x.33319: S
91738841:91738841(0) ack 1275944169 win 5792 <mss
1460,sackOK,timestamp 1298913364 1673506,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 8227 0577 d2d9 4c0d 5ce9 a012 $....'.w..L.\...
0x0030: 16a0 8307 0000 0204 05b4 0402 080a 4d6b ..............Mk
0x0040: d854 0019 8922 0103 0302 .T..."....
01:44:43.972848 IP 216.112.x.x .smtp > 216.156.x.x.33318: S
91768326:91768326(0) ack 1273441885 win 5792 <mss
1460,sackOK,timestamp 1298914194 1673283,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 8226 0578 4606 4be7 2e5d a012 $....&.xF.K..]..
0x0030: 16a0 3c2e 0000 0204 05b4 0402 080a 4d6b ..<...........Mk
0x0040: db92 0019 8843 0103 0302 .....C....
01:44:44.172791 IP 216.112.x.x .smtp > 216.156.x.x.33309: S
41440256:41440256(0) ack 1225349092 win 5792 <mss
1460,sackOK,timestamp 1298914394 1669005,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 821d 0278 5400 4909 57e4 a012 $......xT.I.W...
0x0030: 16a0 1a82 0000 0204 05b4 0402 080a 4d6b ..............Mk
0x0040: dc5a 0019 778d 0103 0302 .Z..w.....
01:44:44.973655 IP 216.112.x.x .smtp > 216.156.x.x.33315: S
67306341:67306341(0) ack 1255049714 win 5792 <mss
1460,sackOK,timestamp 1298915195 1671545,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 8223 0403 0365 4ace 89f2 a012 $....#...eJ.....
0x0030: 16a0 28ac 0000 0204 05b4 0402 080a 4d6b ..(...........Mk
0x0040: df7b 0019 8179 0103 0302 .{...y....
01:44:46.136630 IP 216.156.x.x.33319 > 216.112.x.x .smtp: S
1275944168:1275944168(0) win 5840 <mss 1460,sackOK,timestamp 1673806
0,nop,wscale 0>
0x0000: 0012 3f47 b619 0030 48d4 0528 0800 4510 ..?G...0H..(..E.
0x0010: 003c d5cb 4000 4006 6916 d870 241f d870 .<....@.@.i..p$..p
0x0020: 26ca 8227 0019 4c0d 5ce8 0000 0000 a002 &..'..L.\.......
0x0030: 16d0 7fcf 0000 0204 05b4 0402 080a 0019 ................
0x0040: 8a4e 0000 0000 0103 0300 .N........
01:44:46.136678 IP 216.112.x.x .smtp > 216.156.x.x.33319: S
91738841:91738841(0) ack 1275944169 win 5792 <mss
1460,sackOK,timestamp 1298916358 1673506,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 8227 0577 d2d9 4c0d 5ce9 a012 $....'.w..L.\...
0x0030: 16a0 7755 0000 0204 05b4 0402 080a 4d6b ..wU..........Mk
0x0040: e406 0019 8922 0103 0302 ....."....
01:44:46.174389 IP 216.112.x.x .smtp > 216.156.x.x.33319: S
91738841:91738841(0) ack 1275944169 win 5792 <mss
1460,sackOK,timestamp 1298916395 1673506,nop,wscale 2>
0x0000: 0004 8026 c641 0012 3f47 b619 0800 4500 ...&.A..?G....E.
0x0010: 003c 0000 4000 4006 3ef2 d870 26ca d870 .<....@.@.>..p&..p
0x0020: 241f 0019 8227 0577 d2d9 4c0d 5ce9 a012 $....'.w..L.\...
0x0030: 16a0 7730 0000 0204 05b4 0402 080a 4d6b ..w0..........Mk
0x0040: e42b 0019 8922 0103 0302 .
---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscr...@pfsense.com
For additional commands, e-mail: support-h...@pfsense.com
Commercial support available - https://portal.pfsense.org
