dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
224
share rss forum feed

Bird222

join:2003-08-25

Port 25 showing as closed

I ran a scan from grc.com. Port 25 shows 'closed' instead of 'stealth'. Does anyone know why?



BK3

join:2001-04-10
Geneva, IL

AT&T closes port 25 long before any data is sent via port 25 to your computer. This is done as an anti-malware / anti-spam action, since POP protocol uses port 25 as a default value. AT&T DSL uses ports 465 and 995 (SSL email ports) and not 25, so the blocking by AT&T of port 25 does not affect AT&T POP email.

This may be the reason that you see what you see.


Bird222

join:2003-08-25

said by BK3:

AT&T closes port 25 long before any data is sent via port 25 to your computer. This is done as an anti-malware / anti-spam action, since POP protocol uses port 25 as a default value. AT&T DSL uses ports 465 and 995 (SSL email ports) and not 25, so the blocking by AT&T of port 25 does not affect AT&T POP email.

This may be the reason that you see what you see.

Thanks for the reply. So this is not my firewall setup, it is AT&T doing it on their routers (I kinda suspected this)? I guess I have no chance of getting them to just drop the packets instead of sending a reply?


BK3

join:2001-04-10
Geneva, IL

Not to my knowledge. Someone else may have a resolution for you, but I'm afraid that I do not.


cramer
Premium
join:2007-04-10
Raleigh, NC
kudos:7
reply to Bird222

At various points in history, you could ask to have port 25 unblocked. I'm not sure that's still possible. At any rate, why do you care how the blocked port is answered?



David
Premium,VIP
join:2002-05-30
Granite City, IL
kudos:84
Reviews:
·DIRECTV
·AT&T Midwest
·magicjack.com
·Google Voice
·AT&T Southwest
reply to Bird222

To clear up the questions

1.) yes- AT&T blocks the following ports on residential accounts. Outbound - TCP port 25, Inbound and outbound - TCP ports 135, 139, 445 and 1025

2.) in the past and before 2008 if you had port 25 outbound enabled on AT&T you could request it be unblocked still. Past 2009, if you disconnected and reconnected that option went away. in 2010, irregardless of consumer status, all were blocked at that point. Bellsouth customers were apparently blocked since day 1 when it started for consumer. I believe in present day 2013, all consumer accounts that are new are blocked by default now with no option to remove it.

hopefully that clears a few things up. As most customer migrate to IMAP based email and web based email I suspect the POP and SMTP days will be numbered eventually to the point where people won't use them anymore and leave them "on the cloud".

Also in 2010-2011 timeframe AT&T stopped supporting client based email type of software (outlook, eudora, incredimail, thunderbird, etc..) and only support web based email now. If you can go to mail.yahoo.com and login with your userid and password that is the end of the scope of their support.
--
If you have a topic in the direct forum please reply to it or a post of mine, I get a notification when you do this.
Koetting Ford, Granite City, illinois... YOU'RE FIRED!!



NormanS
I gave her time to steal my mind away
Premium,MVM
join:2001-02-14
San Jose, CA
kudos:9
reply to Bird222

At least one piece of AT&T CPE is actively listening on 3479: Pace 4111.

»2Wire 3801HGV - ports open (even when I didn't open it)

»Re: Pace 4111N
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum



Hayward
K A R - 1 2 0 C
Premium
join:2000-07-13
Key West, FL
kudos:1
reply to Bird222

Virtually all POP apps allow you to specify the send port. Just change it to 465 or 995
--



NormanS
I gave her time to steal my mind away
Premium,MVM
join:2001-02-14
San Jose, CA
kudos:9
reply to BK3

said by BK3:

This is done as an anti-malware / anti-spam action, since POP protocol uses port 25 as a default value.

Eh? The default port for POP (the PostOffice Protocol) is 110.

Port 25 is the default port for "Mail Transfer" (SMTP); which residential users are not expected to be using. Back in 2002/2003 SBC first implemented blocking of port 25 outbound as a spam mitigation measure. At that time, both AT&T and Bellsouth already blocked port 25 bi-directionally (AT&T Worldnet offered both dial-up, and CLEC ADSL services). After SBC bought them both, they (dba AT&T) adopted the same practice.

Port 25 has also been used as the de facto standard for "Message Submission"; though there has been an RFC defined "Message Submission" port, 587, since RFC 2476 was published in 1996. The latest revision I know of is RFC 4409. In addition, port 465 has become the de facto standard for secure (sort of) "Message Submission". All of the major ESPs (AOL, Gmail, Microsoft, Yahoo!, and more) offer either, or both; port 465 and/or port 587.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum


NormanS
I gave her time to steal my mind away
Premium,MVM
join:2001-02-14
San Jose, CA
kudos:9
reply to Hayward

said by Hayward:

Virtually all POP apps allow you to specify the send port. Just change it to 465 or 995

The OP is not trying to use port 25, he is trying to "Stealth" his Internet connection, which requires not responding to port 25 connection attempts with a TCP/IP "RST". Because AT&T is intercepting port 25 connection requests, their hardware is responding.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum


BK3

join:2001-04-10
Geneva, IL
reply to NormanS

said by NormanS:

Eh? The default port for POP (the PostOffice Protocol) is 110.

Whoops - Your are correct in this. My mistake.

However the rest of my post stands. If you just change POP in it to SMTP, it stands corrected.

VvTheDuckvV

join:2013-09-24
Pensacola, FL
reply to Bird222

I still haven't gotten a straight answer out of AT&T about SMTP port 25 INBOUND being blocked. That's a poor techsupport problem on AT&T's behalf, but that's the subject of another discussion entirely. I understand most ISPs have blocked OUTBOUND only for the past 10+ years and claiming on the grounds to prevent spamming botnets... OR perhaps it is to force you to become dependent on their email service? Hmmmm....?

Over the years I have worked for several webhosting companies and I have dealt many calls or helpdesk tickets each day as to why our "SMTP server was down" when in fact it was their ISP's imposed SMTP OUTBOUND firewall rules. Do you think the customer wants to be told that? Not one customer ever listened to me without an argument.

Then one day my mail caching server stopped receiving email... on SMTP INBOUND port 25, I had never heard of any ISP blocking INBOUND before then, and getting them to answer that was impossible, nor was there anything on the website about it.

Anyway, I am glad that this thread answers the question that I have been asking them for years. Thanks guys!



NormanS
I gave her time to steal my mind away
Premium,MVM
join:2001-02-14
San Jose, CA
kudos:9

said by VvTheDuckvV:

I understand most ISPs have blocked OUTBOUND only for the past 10+ years and claiming on the grounds to prevent spamming botnets... OR perhaps it is to force you to become dependent on their email service? Hmmmm....?

I do a lot of Spamcop.net reporting. Between 2000, when I started, and 2003, when SBC and Comcast implemented changes in outbound port 25 control, a lot of reports went to Comcast and SBC abuse. On my mail server, SBC was number one for dubious (residential) inbound, followed by Comcast; ironically, at the time, SBC was the second largest ISP, after Comcast.

Subsequent to their outbound port 25 controls, dubious residential connection attempts from both dropped significantly. I took that as evidence that they did, indeed, mitigate the issue of email abuse from their networks.

Meantime, third party ESPs, such as MyRealBox, GMX (Germany), AOL, Google, and Yahoo! implemented message submission over ports 465 and 587. So SBC and Comcast were not forcing user dependency on their email systems.

Over the years I have worked for several webhosting companies and I have dealt many calls or helpdesk tickets each day as to why our "SMTP server was down" when in fact it was their ISP's imposed SMTP OUTBOUND firewall rules. Do you think the customer wants to be told that? Not one customer ever listened to me without an argument.

Did you not offer message submission access via the usual message submission ports; 465 and/or 587?

Then one day my mail caching server stopped receiving email... on SMTP INBOUND port 25, I had never heard of any ISP blocking INBOUND before then, and getting them to answer that was impossible, nor was there anything on the website about

My current ISP, Sonic.net, is very upfront about blocking port 25 both ways on their dynamic accounts.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

VvTheDuckvV

join:2013-09-24
Pensacola, FL

said by NormanS:

Did you not offer message submission access via the usual message submission ports; 465 and/or 587?

At the time, no. I believe they do lots of things now. But I left working for those companies for some very repeated poor decisions that were made by the execs.... and now they're out of business as I predicted well in advance. I won't even mention names, I don't want the association.