Could not open connection to the host, on port 25: Connect failed

Question

Hi,

On my Azure VM, I cannot connect to port 25.

telnet smtp.sendgrid.net 25 (sendgrid or whatever) return always Could not open connection to the host, on port 25: Connect failed.

I tried Cannot send email (SMTP-Port 25) Diagnostic on Azure portal :

This subscription is authorized to send mail over TCP port 25

I deactivated the firewall (or add rules for the port), nothing works.

Help!

Thanks.

Answer 1

Make sure you have Port 25 is allowed (Inbound or Outbound, based on your requirement) in the Network security group associated with your VM.

Answer 2

Port 25 outbound is usually blocked by default on Azure subscription but this can usually be unblocked upon request if you open a support ticket.

https://learn.microsoft.com/en-us/azure/virtual-network/troubleshoot-outbound-smtp-connectivity

Answer 3

Hi @bedardv ,

Thank you for reaching out to Microsoft Q&A platform. Happy to answer your question.

For VMs that are deployed in standard Enterprise Agreement subscriptions, the outbound SMTP connections on TCP port 25 will not be blocked. For Enterprise Dev/Test subscriptions, the 25 port is blocked by default. You need to submit a support ticket to enable the 25 port. Reference : troubleshoot-outbound-smtp-connectivity

Assuming yours's is a Standard EA subscription and port 25 is not blocked from subscription side. Considering the fact, no firewall/NSG is blocking port 25 on the VM you are referring to, i believe this has something to do with the connectivity.

Best way to troubleshoot this issue is usage of the traceroute with TCP packets. Use this command to check where the packets are blocked:

traceroute -T -p 25 -n <myVMip>
The next step - run the tcpdump on the VM and check incoming packets. The tcpdump captures packets before firewall.

tcpdump -ni <iface> 'port 25'
So, if you see the packets in the dump, but nothing works, then check the firewall. By default the iptables command lists only the filter table. Better use the iptables-save -c command to show the full rule set with rule counters.

Then check, the port is really listened. Use the netstat -tlnp or ss -tlnp 'sport == :25' commands. You should see the listened socket and your program.
If all steps above are done, but the service doesn't work, run the strace -p <pid> command to check, the service really gets data from sockets.

Please "Accept as Answer" if any of above helped so that, it can help others in community looking for remediation for the similar issues.

Answer 4

Hi Bedarv,

I am facing the same issue as you had faced. But the port number is 443.

After a pay-as-you-go subscription, how soon you had seen the result.

Right now, I am not able to connect to the server through ssh (22) even. Using the same private key.

Please answer this.

Thanks