cant access the smtp/pop server

[Maaz]

OS: rhel 4
smtp: Sendmail 8.x
pop: dovecot

some of our users works remotely(vpn clients). thay can access anything, but cant access mails, and neither can send mails. even vpn users can ping mail server, but cant access mails. Configuration of MUA is 100% ok, bcause when these vpn client connect their notebooks to out lan, they can access mails.
VPN server is windows server 2003.

Any help will be highly appreciated

regards
Maaz

[Steven E. Protter]

Shalom Maaz,

Things to check:
1) firewalls and switch configuration. commonly they block popmail.
2)dovecot.conf configuration file. It does not work out of the box.
3) Check the /var/log/maillog file for error codes.

SEP

[Ivan Ferreira]

From the remote clients, you should be able to telnet to the port 25 and 110, so run:

telnet mailserver 25
telnet mailserver 110

You should get answer, if you don't you should try the same locally, if locally works, then your problem is with some filter in your configuration, maybe iptables rules, /etc/hosts.allow and /etc/hosts.deny (tcpwrappers) or another firewall in the middle.

[g33k]

well the ping is not significant test, it can tell you that maschine is up and ICMP packets are not blocked.

But you can easy figure out where the flow is blocked if you will simulate real flow.

Try to telnet is good way but you can only figure out if server is OK or not.

There is tool for linux called tcptraceroute, which sende TCP SYN packet to destionation you want and show you the trace as normal trace route. But traceroute use icmp(on windows) and udp or icmp on UNIX, but smtp and pop are above TCP so if any router, firewall whatever, block tcp ports 25 and 110, you will see.(I mean last adress you will see is OK) but next (I mean ****** mean doesn't respond), it's node that block flow(or is set to not reffer icmp time exceeded).

I hope this helps, you with finding the where the mistake is.

[g33k]

and there are links, because it's not standard software http://freshmeat.net/projects/tcptraceroute/
http://olympus.het.brown.edu/cgi-bin/man/man2html?tcptraceroute+1

[Andrew Bruce]

Hi Maaz,

Something else to consider:

When users on VPN try to access email, what (if any) error messages do they get? In other words, does their email client respond with anything coming back from the email server(s)?

Bear in mind that sendmail (and I expect dovecot, but I'm not familiar with it) can be configured to respond to particular IP subnets, domains, etc.

It is possible, the sendmail configuration is either ignoring the users on the subnet the VPN provides.

It's worth checking what subnet your internal LAN uses, and what subnet your VPN connections have.

Another thing to check is your email relay configuration - same type of issue. Sendmail can be configured to relay email that originates from specific subnets, domains, etc. (this is to prevent spammers hijacking your server).

Any email originating from a processor that is *not* the email server itself is making use of the relay facility. This includes your internal LAN. Once again, different subnets require extra 'rules'...

Failure to relay (and other failures) are often apparent at the email client (the server will respond with messages like 'Relaying not allowed', etc. Of course, this is in addition to information found in the email logs on the server.

If you do have any error messages at the client end, post them up - they may give more of a clue.

IMO your problem is a configuration issue on your email server for users coming in on the VPN subnet rather than firewall or other networking issues. Then again, your VPN server *is* a windows box! :-^

Regards,

Andy Bruce

[Maaz]

MUA is Outlook Express, and the error recieve is following:
The Connection to the server has failed. Account: '10.0.0.33', Server: '10.0.0.33', Protocol: pop3, Port: 110, Secure(ssl): No, Socket Error: 10061; Error Number: 0x800CCC0E

There is no firewall in b/w the client and the mail server.

I didnt check the follwoing:
telnet 10.0.0.33 25
telnet 10.0.0.33 110, but I captured packets on mail server via ethereal, and found that client can successfuly communicate on port 25 and 110.

RELAY ISSUE:
cat /etc/mail/access
10 RELAY

(win xp)client's ip configuration:
IP: 10.100.100.110
MASK: 255.255.255.255

NO Firewall at all.

Regards
Maaz

[Alexander Chuzhoy]

Hi Maaz,
first of all please follow the following link and do everything "they" say.

http://www.tiscali.co.uk/help/email/oe_errors_0x800ccc0e.html

If it won't help and from within LAN the users are able to work - then you'll have to search for some advanced options In Win2003 VPN server.
Best regards.

[Maaz]

Thanks EveryOne for help.
Prblm gone.... i simply reboot the machine(MS Windows vpn server)... and now every thing is working fine


Thanks n Regards
Maaz