Mail server port-scanning my firewall?
 

This is an odd problem I seem to be having.

It seems that sendmail, once every 5 minutes or so will try and initiate a TCP connection with my firewall.

My firewall Log reports : Denied TCP connection from 10.x.x.x , 25. to 10.x.x.x 1028 where the first ip address is my mail server/port number and the second ip address is the firewall and the port number my mail server tried to connect on.

Why in the world would sendmail be trying to initiate tcp connections with my firewall?

For information sake: the mail server is behind the firewall running RedHat ES 3.0 kernel 2.4.21-4 (I know out of date). The version of sendmail I'm running is 8.12.10/8.12.10

Any ideas as to why this is happening?

thanks

Have a closer look at the logs and see what TCP headers the connection has..

It may be sendmail closing a connection after netfilter conntrack has dropped it..

Sendmail's source port wouldn't normally be port 25 for a new connection, it would use a normally available high port for that.

Re: Mail server port-scanning my firewall?
 

Actually, if the source port is 25, then this would be the reply packet (ack). So it looks like your firewall initiated the port 25 connection to your mail server, but your mail server could not reply (ack).