UT filtering incoming email

[srich]

I have a new installation of Untangle with only the Spam and Phish blockers loaded and configured. I have configured the port forward to the internal mail server (Postfix). The UT server is sitting in a Cisco ASA DMZ and the mail server is sitting on the inside network. The UT server is in routing mode with a DMZ address on the External interface and an inside address on the Inside interface (same subnet as the mail server).

Internet -> ASA -> UT -> Postfix

Cisco has verified that the SYN packets are making it through the firewall to the UT server but there is no ACK coming back.

I can't believe it is this difficult to setup. I have 2 other Untangle server that have been up and running like champs for the past 2 years. Why is this one giving me fits?

Port forward
Source interface: External
Protocol: TCP
Destination port: 25
New destination: (ip of postfix server)

Under Advanced->General, I unchecked the Only NAT WAN traffic:

Packet Filter
Action: Pass
Source interface: External
Destination port: 25
Protocol: TCP

I haven't changed any other settings.

[mrunkel]

your mail server is using the untangle as it's default gateway? and why did you uncheck only NAT wan traffic?

[srich]

1) No, the default gateway is not using untangle as it's default gateway. I thought about that since I had seen numerous posts regarding the default gateway so I changed the mail server's default gateway to be the untangle server but no go.

2) It was a guess on my part. I have tried with NAT wan traffic checked and unchecked.

[drsminkus]

Sounds like a classic routing issue. You will want to set the default gateway of your mail server to be the untangle box or else outbound packets will never go back through untangle and the TCP handshake will never complete.

Make sure that you can browse the internet from the Untangle box. Make sure that after you set the default gateway on the mail server that you still get outbound internet access from that server. If you experience trouble you will want to use traceroute to determine where packets might be getting lost.

[srich]

Thanx. Took a bit of reconfiguring the mailserver with static routes for all of our internal subnets and multiple changes to the firewall but it appears to be passing traffic. I have tested all the ports and they all connect.