[SOLVED] Problem sending to external email addresses. After IP switch?

[JpMaxMan]

Hi, I am having a problem sending to external email addresses... this is happening via the web mail system - it says invalid email address. Here is the log, below. I recently had a firewall put in front of the server so the IP did not change for MX record, but it is now operating behind NAT.

Here is what I have checked:

My host file appropriately reflects the private IP of the server for the domain.

I did "zmprov mcf zimbraMtaMyNetworks ''" to add in the new ip range (also including the old values).

I checked the outgoing IP to make sure it matched up to the old public IP - as in in / out same IP.

Here is the log (domain name /emails replaced for security).... thanks!




2008-03-10 13:35:09,245 WARN [btpool0-0] [name=emailaddress@mydomain.com;mid=6;ip=216.27.136 .3;ua=ZimbraWebClient - IE7 (Win)/5.0.2_GA_1975.RHEL5;] smtp - Exception occurred during SendMsg:
com.zimbra.cs.mailbox.MailSender$SafeSendFailedExc eption: 554 5.7.1 <emailaddress@gmail.com>: Relay access denied
; chained exception is:
com.sun.mail.smtp.SMTPAddressFailedException: 554 5.7.1 <emailaddress@gmail.com>: Relay access denied

at com.sun.mail.smtp.SMTPTransport.rcptTo(SMTPTranspo rt.java:1281)
at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTr ansport.java:622)
at javax.mail.Transport.send0(Transport.java:169)
at javax.mail.Transport.send(Transport.java:98)
at com.zimbra.cs.mailbox.MailSender.sendMessage(MailS ender.java:428)
at com.zimbra.cs.mailbox.MailSender.sendMimeMessage(M ailSender.java:248)
at com.zimbra.cs.mailbox.MailSender.sendMimeMessage(M ailSender.java:115)
at com.zimbra.cs.service.mail.SendMsg.doSendMessage(S endMsg.java:184)
at com.zimbra.cs.service.mail.SendMsg.handle(SendMsg. java:150)
at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEng ine.java:342)
at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.jav a:208)
at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.jav a:113)
at com.zimbra.soap.SoapServlet.doPost(SoapServlet.jav a:272)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:727)
at com.zimbra.cs.servlet.ZimbraServlet.service(Zimbra Servlet.java:174)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:820)
at org.mortbay.jetty.servlet.ServletHolder.handle(Ser vletHolder.java:487)
at org.mortbay.jetty.servlet.ServletHandler$CachedCha in.doFilter(ServletHandler.java:1093)
at org.mortbay.servlet.UserAgentFilter.doFilter(UserA gentFilter.java:81)
at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter .java:132)
at org.mortbay.jetty.servlet.ServletHandler$CachedCha in.doFilter(ServletHandler.java:1084)
at org.mortbay.jetty.servlet.ServletHandler.handle(Se rvletHandler.java:360)
at org.mortbay.jetty.security.SecurityHandler.handle( SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(Se ssionHandler.java:181)
at org.mortbay.jetty.handler.ContextHandler.handle(Co ntextHandler.java:716)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebA ppContext.java:406)
at org.mortbay.jetty.handler.ContextHandlerCollection .handle(ContextHandlerCollection.java:211)
at org.mortbay.jetty.handler.HandlerCollection.handle (HandlerCollection.java:114)
at org.mortbay.jetty.handler.HandlerWrapper.handle(Ha ndlerWrapper.java:139)
at org.mortbay.jetty.handler.RewriteHandler.handle(Re writeHandler.java:176)
at org.mortbay.jetty.handler.HandlerWrapper.handle(Ha ndlerWrapper.java:139)
at org.mortbay.jetty.Server.handle(Server.java:313)
at org.mortbay.jetty.HttpConnection.handleRequest(Htt pConnection.java:506)
at org.mortbay.jetty.HttpConnection$RequestHandler.co ntent(HttpConnection.java:844)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser. java:644)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpPa rser.java:205)
at org.mortbay.jetty.HttpConnection.handle(HttpConnec tion.java:381)
at org.mortbay.io.nio.SelectChannelEndPoint.run(Selec tChannelEndPoint.java:396)
at org.mortbay.thread.BoundedThreadPool$PoolThread.ru n(BoundedThreadPool.java:442)
2008-03-10 13:35:09,247 INFO [btpool0-0] [name=emailaddress@mydomain.com;mid=6;ip=216.27.136 .3;ua=ZimbraWebClient - IE7 (Win)/5.0.2_GA_1975.RHEL5;] SoapEngine - handler exception
com.zimbra.cs.mailbox.MailServiceException: Invalid address: emailaddress@gmail.com
Code:mail.SEND_ABORTED_ADDRESS_FAILURE Arginvalid, STR, "emailaddress@gmail.com")
at com.zimbra.cs.mailbox.MailServiceException.interna l_SEND_FAILURE(MailServiceException.java:422)
at com.zimbra.cs.mailbox.MailServiceException.SEND_AB ORTED_ADDRESS_FAILURE(MailServiceException.java:42 6)
at com.zimbra.cs.mailbox.MailSender.sendMimeMessage(M ailSender.java:306)
at com.zimbra.cs.mailbox.MailSender.sendMimeMessage(M ailSender.java:115)
at com.zimbra.cs.service.mail.SendMsg.doSendMessage(S endMsg.java:184)
at com.zimbra.cs.service.mail.SendMsg.handle(SendMsg. java:150)
at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEng ine.java:342)
at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.jav a:208)
at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.jav a:113)
at com.zimbra.soap.SoapServlet.doPost(SoapServlet.jav a:272)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:727)
at com.zimbra.cs.servlet.ZimbraServlet.service(Zimbra Servlet.java:174)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:820)
at org.mortbay.jetty.servlet.ServletHolder.handle(Ser vletHolder.java:487)
at org.mortbay.jetty.servlet.ServletHandler$CachedCha in.doFilter(ServletHandler.java:1093)
at org.mortbay.servlet.UserAgentFilter.doFilter(UserA gentFilter.java:81)
at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter .java:132)
at org.mortbay.jetty.servlet.ServletHandler$CachedCha in.doFilter(ServletHandler.java:1084)
at org.mortbay.jetty.servlet.ServletHandler.handle(Se rvletHandler.java:360)
at org.mortbay.jetty.security.SecurityHandler.handle( SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(Se ssionHandler.java:181)
at org.mortbay.jetty.handler.ContextHandler.handle(Co ntextHandler.java:716)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebA ppContext.java:406)
at org.mortbay.jetty.handler.ContextHandlerCollection .handle(ContextHandlerCollection.java:211)
at org.mortbay.jetty.handler.HandlerCollection.handle (HandlerCollection.java:114)
at org.mortbay.jetty.handler.HandlerWrapper.handle(Ha ndlerWrapper.java:139)
at org.mortbay.jetty.handler.RewriteHandler.handle(Re writeHandler.java:176)
at org.mortbay.jetty.handler.HandlerWrapper.handle(Ha ndlerWrapper.java:139)
at org.mortbay.jetty.Server.handle(Server.java:313)
at org.mortbay.jetty.HttpConnection.handleRequest(Htt pConnection.java:506)
at org.mortbay.jetty.HttpConnection$RequestHandler.co ntent(HttpConnection.java:844)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser. java:644)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpPa rser.java:205)
at org.mortbay.jetty.HttpConnection.handle(HttpConnec tion.java:381)
at org.mortbay.io.nio.SelectChannelEndPoint.run(Selec tChannelEndPoint.java:396)
at org.mortbay.thread.BoundedThreadPool$PoolThread.ru n(BoundedThreadPool.java:442)
Caused by: com.zimbra.cs.mailbox.MailSender$SafeSendFailedExc eption: 554 5.7.1 <emailaddress@gmail.com>: Relay access denied
; chained exception is:
com.sun.mail.smtp.SMTPAddressFailedException: 554 5.7.1 <emailaddress@gmail.com>: Relay access denied

at com.sun.mail.smtp.SMTPTransport.rcptTo(SMTPTranspo rt.java:1281)
at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTr ansport.java:622)
at javax.mail.Transport.send0(Transport.java:169)
at javax.mail.Transport.send(Transport.java:98)
at com.zimbra.cs.mailbox.MailSender.sendMessage(MailS ender.java:428)
at com.zimbra.cs.mailbox.MailSender.sendMimeMessage(M ailSender.java:248)

[phoenix]

In the first line of that log snippet you've posted there is an IP address, is it supposed to be your Zimbra server as I get no response from port 25 at that address. Do you also have a Split DNS set-up? Have you changed all your DNS records to point to the new server IP address?

[JpMaxMan]

In the first line of that log snippet you've posted there is an IP address, is it supposed to be your Zimbra server as I get no response from port 25 at that address. Do you also have a Split DNS set-up? Have you changed all your DNS records to point to the new server IP address?

No - that is the IP address from my ISP that I was accessing the web mail client with.

FYI, it is a RedHat EL 5 server.

Yes, DNS is setup correctly, MX records are in place. This was all working fine before I had the firewall put in place. I could send to any address, was receiving email fine, no issues.

[Podilarius]

No - that is the IP address from my ISP that I was accessing the web mail client with.

FYI, it is a RedHat EL 5 server.

Yes, DNS is setup correctly, MX records are in place. This was all working fine before I had the firewall put in place. I could send to any address, was receiving email fine, no issues.

New firewall might need NAT reflection especially on port 25, 7025, and the web port (i use 8080). What kind of Firewall did you put in place?

Pod

[JpMaxMan]

New firewall might need NAT reflection especially on port 25, 7025, and the web port (i use 8080). What kind of Firewall did you put in place?

Pod

I'm not 100% sure what you mean by reflection. It's a Checkpoint X16 firewall at the planet data center.

Two things I do know, from the terminal of the mail server itself I can telnet to port 25 of the public IP and the request is answered. Is that what you mean by reflection?

I can also do a wget Current IP Check and it reflects my IP as being the public IP that the mx record is pointed to.

[Podilarius]

I'm not 100% sure what you mean by reflection. It's a Checkpoint X16 firewall at the planet data center.

Two things I do know, from the terminal of the mail server itself I can telnet to port 25 of the public IP and the request is answered. Is that what you mean by reflection?

I can also do a wget Current IP Check and it reflects my IP as being the public IP that the mx record is pointed to.

Have a look on the internet about NAT reflection. This is a way that systems that are protected by a firewall to communicate to other systems behind the firewall using thier public address. This also pertains to communicating to it own public IP address. So if you are on a 10.10.10.0 internal network and your external is say 172.16.13.42 and you try to access it from within the network, the firewall has trouble with the NATing. The way around it to do NAT reflection. Sorry for being confusing, I don't know if your firewall has to have NAT reflection on or not. You might want to check out the Admin Guide for it. If you can telnet from the machine to it own public IP and it works you may not have a problem with NAT reflection on port 25, but you still need to have a look at port 7025 for LMTP.

Hope it helps.

Pod

[JpMaxMan]

Have a look on the internet about NAT reflection. This is a way that systems that are protected by a firewall to communicate to other systems behind the firewall using thier public address. This also pertains to communicating to it own public IP address. So if you are on a 10.10.10.0 internal network and your external is say 172.16.13.42 and you try to access it from within the network, the firewall has trouble with the NATing. The way around it to do NAT reflection. Sorry for being confusing, I don't know if your firewall has to have NAT reflection on or not. You might want to check out the Admin Guide for it. If you can telnet from the machine to it own public IP and it works you may not have a problem with NAT reflection on port 25, but you still need to have a look at port 7025 for LMTP.

Hope it helps.

Pod

Thanks - yeah I can access the public IP from the LAN (private IP) side of the firewall.

Thanks for your help anyway though

[JpMaxMan]

Ok! I got this solved w/ a little help from support. The problem was myNetworks was not set w/ the private IP address. I had changed this (or I thought), but when starting the MTA using zmmtactl I noticed:
Wed Mar 12 07:15:18 2008 Executing /opt/zimbra/postfix/sbin/postconf -e mynetworks=''

still had the public IP range, not the private.

Following this instructions:

Outgoing Mail Problems - Zimbra :: Wiki

I adjusted it to the new private IP range and my system is now sending mail again! woot!