83 lines
4.5 KiB
Markdown
83 lines
4.5 KiB
Markdown
# Router SMTP Troubleshooting Reference
|
|
|
|
Tested against `mail.germainebrown.com` (MXroute, port 2525) from a CCR2004-16G-2S+ (RouterOS 7.18.2) behind AT&T residential fiber via a netcup KVM.
|
|
|
|
## Validated Working Config
|
|
|
|
```
|
|
/tool/e-mail/set server=mail.germainebrown.com port=2525 tls=starttls \
|
|
from="g@germainebrown.com" password="<correct-password>"
|
|
/ip/dns/set servers=10.1.1.14,10.1.1.10
|
|
/ip/firewall/filter/add chain=input action=accept connection-state=established,related \
|
|
place-before=1 comment="Allow established/related input"
|
|
```
|
|
|
|
## Error Diagnosis Table
|
|
|
|
| Log Error (`/log/print where topics~"e-mail"`) | Root Cause | Fix |
|
|
|---|---|---|
|
|
| `DNS resolve failed` | Router DNS empty or AT&T DHCP (192.168.1.254) can't resolve mail.germainebrown.com | `/ip/dns/set servers=<internal-dns>` |
|
|
| `timeout occured` | Missing established/related INPUT rule — SMTP connects but return packets are dropped by WAN-DROP | Add input established/related rule (see above) |
|
|
| `AUTH failed` | Wrong SMTP password | `/tool/e-mail/set password="<correct>"` |
|
|
| `succeeded` | Working | Nothing |
|
|
|
|
## The established/related INPUT Rule
|
|
|
|
The router HAS an established/related rule on the **forward** chain (line 13), but unless explicitly added, the **INPUT** chain may lack one. Without it, any connection initiated BY the router (SMTP, DNS, API calls) has its response packets dropped by the WAN-DROP rule on the INPUT chain.
|
|
|
|
**Symptom:** DNS resolved fine, port was correct, AUTH didn't fail — just `timeout occured`. The router's outbound SYN reached the server, the server responded with SYN-ACK, but WAN-DROP on INPUT killed the response before the SMTP process saw it.
|
|
|
|
**Fix location:** Rule must be `chain=input` with `place-before=1` so it sits before WAN-DROP. NOT on the forward chain.
|
|
|
|
## Port Restrictions from netcup KVM
|
|
|
|
Only port **2525** works for outbound SMTP from this netcup box. Ports 25, 465, 587 all timeout. This is a netcup infrastructure restriction, not a router issue.
|
|
|
|
- TLS mode for port 2525: **starttls** (not `yes`/SSL)
|
|
- TLS mode for port 465: **yes** (SSL/TLS direct)
|
|
|
|
## DNS Resolution Path
|
|
|
|
The router's `dynamic-servers` comes from AT&T DHCP (192.168.1.254). AT&T's DNS cannot resolve `mail.germainebrown.com`. The static `servers` override must point to internal DNS (AdGuard at 10.1.1.14, 10.1.1.10).
|
|
|
|
## Verification Command
|
|
|
|
```
|
|
/tool/e-mail/print
|
|
```
|
|
|
|
Look for `last-status: succeeded`. If `failed`, check `/log/print where topics~"e-mail"` for the specific error and cross-reference the table above.
|
|
|
|
## Historical Context (Jul 9, 2026)
|
|
|
|
During the core migration, the home router's SMTP had been broken for months (run-count=0 on all schedulers). The port was still set to 465 (from Hetzner days where port 465 worked). The DNS was using AT&T's DHCP servers. The INPUT chain had no established/related rule. Fixing all three in sequence produced the error progression:
|
|
- DNS fix → `timeout occured` (was DNS resolve failed before)
|
|
- INPUT rule fix → `AUTH failed` (was timeout before)
|
|
- Password update → `succeeded`
|
|
|
|
## Router Scheduler SMTP (Email - Router Logs / Config / Backup)
|
|
|
|
Three schedulers on the home router send daily email backups at 4:00 AM. They had `run-count=0` which means they had never successfully executed. When investigating broken schedulers:
|
|
|
|
1. **Check SMTP first** — `/tool/e-mail/print` shows last-status. If failed, check `/log/print where topics~"e-mail"`
|
|
2. **File name mismatch** — Scheduler uses `file=home-rtr-logs.txt` but `/log print file=logs` creates `logs.txt`, not `home-rtr-logs.txt`. The file created and the file attached by the scheduler MUST match exactly. Fix by making `/log print file=home-rtr-logs` create the correct base name, then attach `.txt`.
|
|
3. **RouterOS 7.18.2 file naming quirks:**
|
|
- `/log print file=<name>` creates `<name>.txt`
|
|
- `/export file=<name>` creates `<name>.rsc` (auto-appends .rsc)
|
|
- `/system backup save name=<name>` creates `<name>.backup`
|
|
- The scheduler's `file=<name>` must include the correct extension
|
|
|
|
**Fix pattern for scheduler scripts:**
|
|
|
|
```
|
|
# Logs — file base name must match across creation and send
|
|
/system/scheduler/set [find where name="Email - Router Logs"] \
|
|
on-event="/log print file=home-rtr-logs\n:\delay 10\n/tool e-mail send \
|
|
to=\"g@germainebrown.com\" subject=\"...\" body=\"...\" file=home-rtr-logs.txt"
|
|
|
|
# Config — export auto-appends .rsc
|
|
/system/scheduler/set [find where name="Email - Router config (RCS)"] \
|
|
on-event="/export file=home-rtr-config\n/tool e-mail send \
|
|
to=\"g@germainebrown.com\" subject=\"...\" body=\"...\" file=home-rtr-config.rsc"
|
|
```
|