Re: no incoming email

From: Marcia (mkp_at_1248.com)
Date: 12/23/04 

Date: Wed, 22 Dec 2004 21:40:37 -0500

I would agree. Yes, I can telnet on port 25 from a client and get a
response. I would agree that it leaves the router in question, except that
this line, from the router:
  192.168.3.101:25 209.195.154.157:25 24.154.1.24:43760 in TCP 3s

This, according to Netopia, shows that it an email came in from the external
side ip 24.154.1.24, port 43760, was received on our public ip, port 25.
Was sent to the ip of our external nic, port 25.

I have no firewalls on the router--temporarily disabled. The only ports
open are: 25, 1723, 3389, 47, 443, and 23.

I found an exchange log that shows email traffic--none are coming in from
the outside.

In defense of MS, the choice was to take work with another engineer or
continue with the same after Christmas. She was certain the problem was in
the router. I agreed until after I spent an hour on the phone conferenced
with both an admin engineer from the ISP and a 2nd tier support engineer
from Netopia. We were able to trace messages going out of my exchange
server all the way through. We were only able to see the messages until it
hit our exchange server. In other words, the above lines shows it being
passed off to our external nic. I assume the log I found that showed all
other email would also show outside->in. The log was c:\program
files\exchange\20041221.log.

I did email the support engineer all the above information and haven't heard
anything yet.

The support people spent several hours with me and were very good. I can't
complain at all other than the problem is still not resolved. IIS was
corrupted. I didn't realize how much interconnectivity exists between IIS
and Exchange.

Thanks.

Marcia

"Les Connor [SBS Community Member]" <les.connor@DEL.cfive.ca> wrote in
message news:%23zBM81I6EHA.248@TK2MSFTNGP10.phx.gbl...
> Marcia,
>
> Telnet on port 23 proves nothing. Try and telnet on port 25, there is no
> answer.
>
> did you get all the tests I ran previously, posted to one of your older
> threads ?
>
> I still cannot get a connection on port 25, and a port scan doesn't show
> it responding either. I can't believe MS cannot tell you the port is not
> open or responding, or that they'd make you wait until after Christmas.
> That's ridiculous.
>
> If the SBS is configured correctly, and the ISP is positive there are no
> problems on his end, then that leaves the router as a prime suspect.
>
> --
> Les Connor [SBS Community Member]
> -----------------------------------------------------------
> SBS Rocks !
>
>
> "Marcia" <mkp@1248.com> wrote in message
> news:eGMlXTH6EHA.2316@TK2MSFTNGP15.phx.gbl...
>> Yes I have. Telnet doesn't work, I get "connection to host lost". Yet,
>> when I login to the router, I get the following:
>>
>>
>> #ip nat trans
>> ; error -121: illegal operation
>> #show ip nat trans
>> LAN IP address--Port--WAN IP address--Port--Rem IP
>> Address--Port--Dir-Prot-h:mm
>> 192.168.3.101:54408 209.195.154.157:61074 216.83.180.138:80 out TCP
>> >10h
>> 192.168.3.101:54386 209.195.154.157:61056 207.46.245.156:80 out TCP
>> >10h
>> 192.168.3.101:54409 209.195.154.157:61075 216.83.180.138:80 out TCP
>> >10h
>> 192.168.3.101:54275 209.195.154.157:61025 216.207.61.196:80 out TCP
>> >10h
>> 192.168.3.101:54340 209.195.154.157:61038 192.168.52.100:161 out UDP
>> 1s
>> 192.168.3.101:54340 209.195.154.157:61039 192.168.53.100:161 out UDP
>> 25s
>> 192.168.3.101:3003 209.195.154.157:61015 198.190.226.3:53 out UDP
>> 0:02
>> 192.168.3.101:54404 209.195.154.157:61070 64.154.80.197:80 out TCP
>> >10h
>> 192.168.3.101:53287 209.195.154.157:60460 208.22.33.46:80 out TCP
>> >10h
>> 192.168.3.101:54268 209.195.154.157:61022 66.18.100.2:80 out TCP
>> >10h
>> 192.168.3.101:25 209.195.154.157:25 68.162.151.136:1569 in TCP
>> 7s
>> 192.168.3.101:54373 209.195.154.157:61045 66.18.100.2:80 out TCP
>> >10h
>> 192.168.3.101:54402 209.195.154.157:61068 207.68.178.238:80 out TCP
>> >10h
>> 192.168.3.101:54403 209.195.154.157:61069 207.68.178.238:80 out TCP
>> >10h
>> 192.168.3.101:54401 209.195.154.157:61067 81.52.248.15:80 out TCP
>> >10h
>> 192.168.3.101:54398 209.195.154.157:61064 81.52.248.41:80 out TCP
>> >10h
>> 192.168.3.100:23 209.195.154.157:23 24.154.49.184:1093 in TCP
>> >10h
>> 192.168.3.101:54276 209.195.154.157:61026 66.18.100.113:80 out TCP
>> >10h
>> 192.168.3.101:54407 209.195.154.157:61073 81.52.248.71:80 out TCP
>> >10h
>> 192.168.3.101:54247 209.195.154.157:61008 65.119.205.137:80 out TCP
>> >10h
>> 192.168.3.101:49787 209.195.154.157:57807 208.22.33.46:80 out TCP
>> >10h
>> Total entries in NAT cache: 21
>> #show ip nat trans
>> LAN IP address--Port--WAN IP address--Port--Rem IP
>> Address--Port--Dir-Prot-h:mm
>> 192.168.3.101:54408 209.195.154.157:61074 216.83.180.138:80 out TCP
>> >10h
>> 192.168.3.101:54409 209.195.154.157:61075 216.83.180.138:80 out TCP
>> >10h
>> 192.168.3.101:54275 209.195.154.157:61025 216.207.61.196:80 out TCP
>> >10h
>> 192.168.3.101:25 209.195.154.157:25 209.195.133.6:4445 in TCP
>> 4s
>> 192.168.3.101:3003 209.195.154.157:61015 198.190.226.3:53 out UDP
>> 0:01
>> 192.168.3.101:54404 209.195.154.157:61070 64.154.80.197:80 out TCP
>> >10h
>> 192.168.3.101:53287 209.195.154.157:60460 208.22.33.46:80 out TCP
>> >10h
>> 192.168.3.101:54268 209.195.154.157:61022 66.18.100.2:80 out TCP
>> >10h
>> 192.168.3.101:54373 209.195.154.157:61045 66.18.100.2:80 out TCP
>> >10h
>> 192.168.3.101:54402 209.195.154.157:61068 207.68.178.238:80 out TCP
>> >10h
>> 192.168.3.101:54403 209.195.154.157:61069 207.68.178.238:80 out TCP
>> >10h
>> 192.168.3.101:54401 209.195.154.157:61067 81.52.248.15:80 out TCP
>> >10h
>> 192.168.3.101:54398 209.195.154.157:61064 81.52.248.41:80 out TCP
>> >10h
>> 192.168.3.100:23 209.195.154.157:23 24.154.49.184:1093 in TCP
>> >10h
>> 192.168.3.101:25 209.195.154.157:25 24.154.1.24:43760 in TCP
>> 3s
>> 192.168.3.101:54407 209.195.154.157:61073 81.52.248.71:80 out TCP
>> >10h
>> 192.168.3.101:54247 209.195.154.157:61008 65.119.205.137:80 out TCP
>> >10h
>> 192.168.3.101:49787 209.195.154.157:57807 208.22.33.46:80 out TCP
>> >10h
>> Total entries in NAT cache: 18
>> #
>>
>> Notice 4 lines up is the email that attempted to come in.
>>
>> #show ip nat trans
>> LAN IP address--Port--WAN IP address--Port--Rem IP
>> Address--Port--Dir-Prot-h:mm
>> 192.168.3.101:54437 209.195.154.157:61094 66.18.100.113:80 out TCP
>> >10h
>> 209.195.154.157:445 209.195.154.157:445 209.195.116.34:1450 in TCP
>> 26s
>> 192.168.3.101:53287 209.195.154.157:60460 208.22.33.46:80 out TCP
>> >10h
>> 192.168.3.101:54268 209.195.154.157:61022 66.18.100.2:80 out TCP
>> >10h
>> 209.195.154.157:445 209.195.154.157:445 209.195.72.84:2469 in TCP
>> 29s
>> 192.168.3.101:54373 209.195.154.157:61045 66.18.100.2:80 out TCP
>> >10h
>> 192.168.3.101:54447 209.195.154.157:61095 66.18.100.2:80 out TCP
>> >10h
>> 192.168.3.101:54398 209.195.154.157:61064 81.52.248.41:80 out TCP
>> >10h
>> 192.168.3.101:54247 209.195.154.157:61008 65.119.205.137:80 out TCP
>> >10h
>> 192.168.3.100:23 209.195.154.157:23 24.154.49.184:1129 in TCP
>> >10h
>> 192.168.3.101:49787 209.195.154.157:57807 208.22.33.46:80 out TCP
>> >10h
>> Total entries in NAT cache: 11
>> #
>>
>> Notice 3 lines up lets me telnet in.
>>
>> Any other ideas would be greatly appreciated. Thanks.
>>
>> Marcia
>>
>>
>> "Bradley Dinerman [MVP - Windows Networking]"
>> <NewsPost@DoNotSpam.neisg.org.DoNotSpam> wrote in message
>> news:OUyrJzG6EHA.616@TK2MSFTNGP09.phx.gbl...
>>> Are you certain that mail from the outside is reaching the inside? Have
>>> you done a TELNET to port 25 of your system from the Internet using the
>>> public IP address of your mail server? What about by DNS name?
>>>
>>>
>>> ______________________________________
>>> Bradley J. Dinerman, MVP - Windows Server Systems
>>> President, New England Information Security Group
>>> http://www.neisg.org
>>>
>>> Marcia wrote:
>>>> Hi! After several hours with MS PSS, I still have no incoming email.
>>>> We left it with follow up phone meeting on Monday after Christmas. The
>>>> manufacturer of our router showed me messages coming into the router.
>>>> Our ISP says they only get held on their backup server if our server
>>>> doesn't accept them.
>>>>
>>>> MS spent some considerable time verifying DNS and ISA, Exchange and IIS
>>>> and saw no reason that they weren't coming through.
>>>>
>>>> My question to this group is twofold:
>>>> 1. Is there anything within remote connections, the external nic, or
>>>> other routing mechanism besides ISA that will reject it?
>>>> 2. Are there logs on the server that verifies that email came in?
>>>>
>>>> Thanks.
>>>>
>>>> Marcia
>>>>
>>
>
>

Relevant Pages

  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)
  • Re: Cost of setting up a network
    ... A router capable of acting as a VPN endpoint for more than one user simultaneously with four Ethernet ports or a switch to suit. ... The rationale for using a server here is basically that the router doesn't need to be able to decide which PC to route the connection to. ... If you are using a router which supports it, you can set up a port-forwarding inbound rule which also _translates_ the port supplied to the receiving port. ... You can use several of these connections to different machines simultaneously. ...
    (uk.comp.homebuilt)
  • How did they get behind my NAT?
    ... this point I panicked and shutdown the VNC service ASAP. ... My question is how the attacker got to my VNC port! ... the internet through the router. ... client connection using local port number 5900 (which was also being ...
    (alt.computer.security)
  • RE: [Full-Disclosure] Microsoft urging users to buy Harware Firewalls
    ... connections between multiple computers. ... A Linksys NAT router box is selling for only $40 at Amazon ... Besides protecting against the MSBlaster worm, a hardware ... Then the user finds about port forwarding, and as soon as the user ...
    (Full-Disclosure)
  • Re: Connecting to Home Computer
    ... cannot transmit IP packets outside the local network). ... assigned by your router. ... You have to add the port too, ... Determine the ports (pcAnywhere uses 5631 for DATA, 5632 for STATUS, I ...
    (microsoft.public.windowsxp.work_remotely)