Timeout, on access to MTA/25, from offsite over SSH tunnel
List good morning,
I am trying to access our MTA from offsite over an SSH tunnel, but the
MUA (Thunderbird) is reporting a timeout on accessing the MTA.
The server is Wheezy; sshd is running; the tunnel is set up to
terminate on the same server that runs the MTA (exim), as well as
running other services; exim is running; the same SSH tunnel works
fine for access over the tunnel to other services (sftp, imap) on the
same server. Additionally, when not using a tunnel, offsite devices
can access the MTA without difficulty; exim is allowing connections.
The server host is behind a NAT (forwarding of port 22 is working fine
to this server) and the server LAN address is 192.168.0.199
The device running the MUA is usually a laptop (and the same symptoms
occur whether a laptop is running Windows/Putty, Fedora/gSTM, or
Wheezy/gSTM), and the laptops are set to tunnel to the server (using a
DNS lookup) and create a Dynamic tunnel on (say) port 9999.
The MUA is set to proxy over localhost port 9999 (this picks up the
SSH tunnel). The MUA's IMAP server configuration is 192.168.0.199
(note that this is also the host that the SSH tunnel terminates on)
and access to the IMAP mail store over the SSH tunnel works without
problems. This indicates that the MUA proxy is working, that the
tunnel is working, that the MUA's IMAP server configuration is ok and
its access to the IMAP service is working.
The MUA's outbound email server is also configured as 192.168.0.199.
(The MTA and the IMAP server are both running on this server,
192.168.0.199.) Access to the MTA, over the SSH tunnel, for outbound
email results in the MUA reporting an access timeout, and this is
before any STARTTLS or any login attempt.
I wondered whether there might be some 'routing' problem on the
server, at the point of the SSH tunnel output (as it were) that meant
that a packet for 192.168.0.199 - which is itself - takes a long time
to get to itself, or even gets lost. So I did another test, logging
in to the server (not over a tunnel, just from the LAN) and issued:
$ telnet 192.168.0.199 25
which was followed by a delay of around a couple of seconds or so before
220 mail.domain.tld ESMTP Exim 4.80 Mon, 03 Aug 2015, 08:37 +0200
which looks good - except, possibly, for the delay. I checked again,
this time using localhost instead of 192.168.0.199:
$ telnet localhost 25
which was followed by a delay of around a second before
220 mail.domain.tld ESMTP Exim 4.80 Mon, 03 Aug 2015, 08:39 +0200
So, on this server, using 'localhost' to access some running service
on the machine is a second or so faster than using its LAN IP address.
Incidentally, this server employs a geo-stationary satellite and its
DNS resolution is over the satellite link. I wondered whether the
server might be doing a DNS lookup for 192.168.0.199, but it wouldn't,
would it?
May I ask the list for some advice how to avoid the timeout? I'm open
to suggestions as to how to alter the arrangements while keeping
outbound email from the laptops over an SSH tunnel. If possible, I'd
like to keep the MUA configurations as 192.168.0.199 because that
means the MUA would continue to work even if a different tunnel is
used that terminates on some other LAN machine - but I am open to
reconsidering that.
I'd be grateful for any suggestions or insights,
regards, Ron
Reply to: