Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a little disapointed !

My aim was to build a VERY simple smtp proxy under debian to handle mail from a port (51234) and forward it to the standard 25 port. I compile and install a "delegate" witch can handle easily that.

It's working very well like that :

delegated SERVER="smtp://anotherSmtpServer:25" -P51234

The strange thing is, it's working on my virtual test machine and on the dedicated server in local but I can't manage to use it trought internet. I test it like that.

telnet [mySrv] 51234

Of course, no firewal, no deny host, no ined/xined, the service delegated is listening on the right port ...

2 clues :

  • The port is answering trought internet with nmap as "51234/tcp open tcpwrapped"
  • have a look at the tcpdump following :

22:50:54.864398 IP [myIp].1699 > [mySrv].51234: S 2486749330:2486749330(0) win 65535

22:50:54.864449 IP [mySrv].51234 > [myIp].1699: S 2486963525:2486963525(0) ack 2486749331 win 5840

22:50:54.948169 IP [myIp].1699 > [mySrv].51234: . ack 1 win 64240

22:50:54.965134 IP [mySrv].43554 > [myIp].auth: S 2485396968:2485396968(0) win 5840

22:50:55.243128 IP [myIp] > [mySrv]: ICMP [myIp] tcp port auth unreachable, length 68

22:50:55.249646 IP [mySrv].51234 > [myIp].1699: F 1:1(0) ack 1 win 46

22:50:55.309853 IP [myIp].1699 > [mySrv].51234: . ack 2 win 64240

22:50:55.310126 IP [myIp].1699 > [mySrv].51234: F 1:1(0) ack 2 win 64240

22:50:55.310137 IP [mySrv].51234 > [myIp].1699: . ack 2 win 46

The part "auth" seems suspect to me but didn't ring a bell. I could certaily do with some help. Thx a lot !

share|improve this question

The "auth" is the port 113, auth/ident. Tcpdump is showing you it the protocol name because it is a well known service. It should be listed in /etc/services. That means that there is nothing listing on mySrv port 113, which is not surprising, no one really uses that service; it isn't that useful.

I don't know anything about delegate so nothing there. If you can't get that working, you could use an iptables DNAT rule to do the port mapping instead. See this howto if you are interested. It would be a simple port mapping, not an application level proxy as delegate lists itself. For example:

iptables -t nat -A PREROUTING -d [srvIp] --dport 51234 -j DNAT --to-destination [smtpID]:25
share|improve this answer
You're right. For the moment i'll stay on the network layer, it'll be easier. Thanks ! – user26604 Feb 14 '10 at 20:23

I did some work on the solution and the issue was so obvious ... It's related of the software. Delegate forbid the transaction of the host outside of his network.

By adding PERMIT="::*:*" the software did his job flawlessy. Here is the network cmd lines solution I used momentarily :

iptables -t nat -D PREROUTING -p tcp -d [MyIP] --dport 51234 -j DNAT --to-destination [THeSMTPRelay]:25
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .