Use NAT to redirect port 25 (inbound) to a VM

Question

Use NAT to redirect port 25 (inbound) to a VM

Thomas Martinez 20

Hello,

I'm trying to setup a redirection using DNAT from Exchange online on port 25, to a virtual machine in my infrastructure.

I've a virtual wan, with a virtual hub setup as secured hub, so with an azure firewall. I would like to redirect the traffic coming from internet on the port 25 on the firewall, to a virtual machine connected using a VNET connection:

User's image

I've created a DNAT rules:

User's image

But I keep on getting this error from exchange online:

User's image

Is it something that's not possible that way ?

Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-03T11:58:53.6666667+00:00
Hello Thomas Martinez

I understand that you're trying to set up a DNAT rule for redirecting inbound traffic on port 25 to a virtual machine through an Azure Firewall.

Here are a few points to consider on troubleshooting this issue:

NOTE: Azure blocks outbound SMTP connections on port 25 for deployed VMs for security reasons. If you’re trying to send emails from your VM using this port, you may need an authenticated SMTP relay service, such as SendGrid or Exchange Online Protection.

Please ensure you set up an inbound NAT rule correctly. Check that your Azure Firewall configuration is linked properly to the NAT rule you've created and ensure that you've specified the right incoming port (25) and the correct destination IP and ports for your VM.

If you have Network Security Groups (NSGs) configured, verify that the firewall rules allow traffic on port 25 to your VM.

You can use the Test-NetConnection command to check connectivity for TCP port 25:

Test-NetConnection <smtp-fqdn> -Port 25

You can also use Connection troubleshoot to check if NSG is blocking port 25 and share the screenshot with me.

Additionally, review the logs on the Azure Firewall to diagnose if traffic is being blocked due to misconfiguration.

Could you provide the following details for further assistance:

What type of Azure subscription do you have (e.g., Enterprise, Pay-As-You-Go)?

Are you seeing blocked traffic in the Azure Firewall logs or anywhere else?

If above is unclear and/or you are unsure about something add a comment below.

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Thomas Martinez 20 Reputation points

2025-06-03T12:02:31.9866667+00:00

Hey,

I'm trying to setup DNAT for Inbound mails only.

There is no NSG.
I'm using an Entreprise Azure Subscription.

There is no log anywhere unfortunately
Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-03T12:14:54.72+00:00

Hello Thomas Martinez

I initiated a private message to you. Please check and share the required details there.
Alex Burlachenko 11,575 Reputation points

2025-06-03T14:47:47.12+00:00
hi Thomas Martinez ))

ur trying to redirect exchange online SMTP traffic (port 25) to ur VM using azure firewall's DNAT, but hitting that "connection refused" error.

microsoft actually blocks inbound port 25 by default in azure to prevent spam. They are strict about this one. u gotta request them to unblock it specifically for ur subscription microsoft port 25 docs

ur DNAT rule looks correct on surface, u got exchange online IPs as source, port 25, etc. but the secured hub plus firewall combo might be adding complexity, and check pls

did u already get microsoft to unblock port 25 for u? if not, that's step zero ))

ur VM needs to have proper network security group rules allowing port 25 inbound

check if the VM itself is listening on port 25 (netstat -ano | findstr :25 on windows)

azure firewall needs application rules allowing SMTP, not just network rules

aha! and here's the kicker exchange online might not play nice with forced SMTP redirects. they prefer modern protocols like TLS endpoints. u might wanna consider using connector instead exchange connector docs

MSFT really wants us to use their smarter solutions rather than brute forcing SMTP ))

contact azure support to unblock port 25 (yes its annoying but required) triple check all firewall/NSG rules. test if u can reach the VM internally on port 25 first. maybe consider using different port externally and translate to 25 internally? sneaky but works sometimes ))

hope this helps :)) let me know

Rgds,

Alex

and "yes" if you would follow me at Q&A - personaly thx. P.S. If my answer help to you, please Accept my answer PPS That is my Answer and not a Comment

https://ctrlaltdel.blog/
Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-04T08:40:43.4233333+00:00

Hello Thomas Martinez

I initiated a private message to you. Please check and share the required details there.
Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-05T08:33:39.5366667+00:00

Hello Thomas Martinez

I initiated a private message to you. Please check and share the required details there.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-05T13:00:30.8266667+00:00

Hi Thomas Martinez,

If you're using an Azure Enterprise Subscription, you can follow the outlined steps below for Enterprise and MCA-E
If you're using a subscription type that isn't an Enterprise Agreement or MCA-E, we encourage you to use an authenticated SMTP relay service

I hope this helps to resolve your query.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-06T04:56:18.78+00:00

Hi Thomas Martinez,
I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Your answer

Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-03T11:58:53.6666667+00:00

Hello Thomas Martinez

I understand that you're trying to set up a DNAT rule for redirecting inbound traffic on port 25 to a virtual machine through an Azure Firewall.

Here are a few points to consider on troubleshooting this issue:

NOTE: Azure blocks outbound SMTP connections on port 25 for deployed VMs for security reasons. If you’re trying to send emails from your VM using this port, you may need an authenticated SMTP relay service, such as SendGrid or Exchange Online Protection.

Please ensure you set up an inbound NAT rule correctly. Check that your Azure Firewall configuration is linked properly to the NAT rule you've created and ensure that you've specified the right incoming port (25) and the correct destination IP and ports for your VM.

If you have Network Security Groups (NSGs) configured, verify that the firewall rules allow traffic on port 25 to your VM.

You can use the Test-NetConnection command to check connectivity for TCP port 25:

Test-NetConnection <smtp-fqdn> -Port 25

You can also use Connection troubleshoot to check if NSG is blocking port 25 and share the screenshot with me.

Additionally, review the logs on the Azure Firewall to diagnose if traffic is being blocked due to misconfiguration.

Could you provide the following details for further assistance:

What type of Azure subscription do you have (e.g., Enterprise, Pay-As-You-Go)?

Are you seeing blocked traffic in the Azure Firewall logs or anywhere else?

If above is unclear and/or you are unsure about something add a comment below.

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Thomas Martinez 20 Reputation points

2025-06-03T12:02:31.9866667+00:00

Hey,

I'm trying to setup DNAT for Inbound mails only.

There is no NSG.
I'm using an Entreprise Azure Subscription.

There is no log anywhere unfortunately
Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-03T12:14:54.72+00:00

Hello Thomas Martinez

I initiated a private message to you. Please check and share the required details there.
Alex Burlachenko 11,575 Reputation points

2025-06-03T14:47:47.12+00:00

hi Thomas Martinez ))

ur trying to redirect exchange online SMTP traffic (port 25) to ur VM using azure firewall's DNAT, but hitting that "connection refused" error.

microsoft actually blocks inbound port 25 by default in azure to prevent spam. They are strict about this one. u gotta request them to unblock it specifically for ur subscription microsoft port 25 docs

ur DNAT rule looks correct on surface, u got exchange online IPs as source, port 25, etc. but the secured hub plus firewall combo might be adding complexity, and check pls

did u already get microsoft to unblock port 25 for u? if not, that's step zero ))

ur VM needs to have proper network security group rules allowing port 25 inbound

check if the VM itself is listening on port 25 (netstat -ano | findstr :25 on windows)

azure firewall needs application rules allowing SMTP, not just network rules

aha! and here's the kicker exchange online might not play nice with forced SMTP redirects. they prefer modern protocols like TLS endpoints. u might wanna consider using connector instead exchange connector docs

MSFT really wants us to use their smarter solutions rather than brute forcing SMTP ))

contact azure support to unblock port 25 (yes its annoying but required) triple check all firewall/NSG rules. test if u can reach the VM internally on port 25 first. maybe consider using different port externally and translate to 25 internally? sneaky but works sometimes ))

hope this helps :)) let me know

Rgds,

Alex

and "yes" if you would follow me at Q&A - personaly thx. P.S. If my answer help to you, please Accept my answer PPS That is my Answer and not a Comment

https://ctrlaltdel.blog/
Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-04T08:40:43.4233333+00:00

Hello Thomas Martinez

I initiated a private message to you. Please check and share the required details there.
Ganesh Patapati 7,165 Reputation points Microsoft External Staff Moderator

2025-06-05T08:33:39.5366667+00:00

Hello Thomas Martinez

I initiated a private message to you. Please check and share the required details there.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-05T13:00:30.8266667+00:00

Hi Thomas Martinez,

If you're using an Azure Enterprise Subscription, you can follow the outlined steps below for Enterprise and MCA-E
If you're using a subscription type that isn't an Enterprise Agreement or MCA-E, we encourage you to use an authenticated SMTP relay service

I hope this helps to resolve your query.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-06T04:56:18.78+00:00

Hi Thomas Martinez,
I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Share via

Use NAT to redirect port 25 (inbound) to a VM

Your answer