How to display log of outgoing traffic from specific LAN ip address to specific WAN

Options
Dave_Melnyk
Dave_Melnyk Posts: 2 image  Freshman Member
in Security

Hi Folks:

I am trying to set up a second mail server (testing new mail server software) and having problems with outgoing mail being blocked. I am trying to determine if SMTP traffic from the server is actually being sent out over the WAN. (WAN2)

I have a mail server running on WAN1 which is working perfectly and despite restricting the test mail server to WAN2 and setting it up identically to the server running on WAN1 everything seems to work except out going mail which indicates it has been sent, but disappears into the ether of the internet. The servers are restricted to using their respective WANs via policy routing.

I am trying to figure out how to set my Zyxel USG 200 Flex to display out going traffic from a specific server (both mail servers run as separate VMs on a single host) to see if the SMTP traffic is actually reaching the WAN to determine if the problem is with the VM, mailserver software configuration or outbound mail handling at DuoCircle.

The new mail server reports a "Whatismyip" query as the appropriate IP (Rogers) for WAN2. Same for the original mail server on WAN1 (appropriate WAN1 IP - Bell).

The difficulty I am having is trying to set a routing policy to be able to log outgoing traffic from the new mail server and set the appropriate filters to display it in the log files of Zyxel USG Flex 200.

Any assistance would be greatly appreciated. Keep in mind I need the "Zyxel Configuration for Dummies" version of an explanation!

Thanks in advance, cheers …. Dave Melnyk (dave@notjuthotair.com)

All Replies

  • Zyxel_Tina
    Zyxel_Tina Posts: 933 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    Options

    Hi @Dave_Melnyk,

    Welcome to the Zyxel Community!

    In the Zyxel USG FLEX 200, Policy Routes are designed purely to steer traffic through a specific gateway or WAN interface, but they do not generate traffic logs on their own. To track and display the outgoing SMTP traffic, you must configure a Security Policy (firewall rule) that matches this specific traffic flow and has logging enabled.

    Step 1: Create an Address Object for Your Test Server

    Before creating the rule, make sure the Zyxel knows the specific IP address of your test VM.

    1. Go to Configuration > Object > Address.
    2. Click Add.
    3. Configure the following:
      • Name: Test_Mail_Server
      • Address Type: Host
      • IP Address: [Enter the LAN IP address of your test mail server VM]
    4. Click OK.

    Step 2: Create a Security Policy Rule with Logging Enabled

    This rule will allow the traffic to pass and force the firewall to write an entry to the log every time it matches.

    1. Go to Configuration > Security Policy > Policy Control.
    2. Click Add to create a new rule.
    3. Configure the following:
      • Name: Log_Test_SMTP
      • From: LAN (or whichever local zone your VM is in, e.g., LAN1)
      • To: WAN
      • Source: Select the Test_Mail_Server object you created in Step 1.
      • Destination: any
      • Service: Select SMTP (port 25) and/or SMTPS (port 465). If your mail software submits mail over port 587, please create a custom Service Object for TCP port 587, and select that as well.
      • Action: allow
      • Log matched traffic: Select log or log-alert.
    4. Click OK to save.

    Note: Ensure this new rule is placed at or near the top of your Security Policy list so it is processed before generic LAN-to-WAN rules.

    If the Log Shows the Traffic Went Out, But Mail Is Still Not Delivered

    Please note that the Security Policy log only confirms whether the packet entered or left the firewall; it does not confirm whether the mail server actually received it.

    If the log shows that the traffic is being correctly forwarded through WAN2 but the email still does not arrive, the next step is to perform a packet capture under Maintenance > Diagnostics > Packet Capture on the WAN2 interface while sending a test email. This will allow us to investigate the issue further.

    Zyxel Tina

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）