disconnected during smtp transfer

If I turn off spam blocker is there anything else that will block smtp connections?

I have one person that can not email a client of mine that is behind a untangle, it is an aol email address and they get the following bounce back
SMTP; 451 4.4.1 reply: read error.

I have checked and turned off everything and nothing has worked.

The only reason I think this might be a untangle issue is because I had the aol user email us directly and we use GFI to filter spam before it gets to our untangle and GFI reported Status Reply:Disconnected during SMTP transfer when trying to deliever the email to our exchange server behind our untangle.

They only thing the same on these sites is that they both have untangle, one has exchange 2010 and one has 2003.

Thanks for any help

Outgoing SMTP is not processed by Untangle.

If I were you I'd be attacking the AV client on that workstation.

Also, do you have Intrusion Prevention installed? Try turning that off.

its incoming email. user from outside that has an aol email address can not email my client that is behind the untangle.

I just disabled the intrustion protection on my server and the email that GFI could not deliever to me from that same AOL user just came through....So intrustion protection blocks emails? what are my next steps to figure out why it is blocked with intrusion protection?

Thanks for the quick reply!

I would take a look at the logs in Intrusion Prevention. Most likely it's only one rule causing false positive in this case. Just turn off that rule instead of the entire app.

Quote:

---

Originally Posted by logicsound

its incoming email. user from outside that has an aol email address can not email my client that is behind the untangle.

I just disabled the intrustion protection on my server and the email that GFI could not deliever to me from that same AOL user just came through....So intrustion protection blocks emails? what are my next steps to figure out why it is blocked with intrusion protection?

Thanks for the quick reply!

---

Intrusion Prevention deals with all traffic, it isn't a matter of SMTP or not. Bottom line, the module actually works in 9.0. So unless you want to be in there tinkering and tuning, I suggest you simply turn it off.

JCoffin is correct, there is likely an easy to find rule violation in the logs now that you can disable that specific rule. However, be aware that IDS systems have false positives all the time. This is simply par for the course. So if you're not wanting to deal with this, turn the module off.

Could not find an exact time match but I think it is the following rule causing it

#11837 SMTP MS WINDOWS MAIL UNC navigation remote command execution

Anybody know what this rule is doing? I know I can turn the rule off but I would like to know what this rule does and what it sees in the email to block it so I can relay this to my client. (yes I did google it, but found nothing)
Thanks
Trevor

Anybody know what that rule does?

http://www.snort.org/search/sid/1-11837