Problem with Kerio.

  • Thread starter Thread starter John Corliss
  • Start date Start date
J

John Corliss

I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?
 
John said:
I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?
Click to expand...

I am running Kerio with AVG and I do not notice any delays with them on.
What rules do you have for the email client? I believe that it needs
access to ports 25 SMTP, 110 POP3, 119 NNTP and 113 IDENT. The way I find
this is to enable the alert for the "Block all" rule and the rule for the
email client and look at the alerts. There may be a logging function in
the email client that you can enable.
 
YoKenny said:
I am running Kerio with AVG and I do not notice any delays with them on.
What rules do you have for the email client? I believe that it needs
access to ports 25 SMTP, 110 POP3, 119 NNTP and 113 IDENT. The way I find
this is to enable the alert for the "Block all" rule and the rule for the
email client and look at the alerts. There may be a logging function in
the email client that you can enable.
Click to expand...

YoKenny,
I'm also running Kerio with AVG. However, turning off AVG has no
effect on email access and delivery while turning off Kerio does.

I don't see a separate listing for the Mozilla mail/news reader. There
is a listing only for "Mozilla" and the ports it's accessing are:

25 (to access my ISP's email server)
110 (to send out email)

I'm using a fiber optic cable connection rather than a dialup. I've
got the rule for Mozilla set up to allow it to use any port using TCP.
On the other hand, I have rules set up to block any ICMP (both
outgoing and incoming) and IGMP. I've also disabled incoming TCP and
all UDP to "System". I know that the order I have them placed makes a
difference too (top ones take precedence.)

I'm new at this stuff, so there are undoubtedly mistakes that I've
made. Guess I should really take this to:
 
I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?
Click to expand...
Dont know if youve seen this site but theres quite a few rules for kerio
there plus info,that might help.
http://www.blarp.com/faq/faqmanager.cgi?toc=kerio
me
 
I had a similar problem with an earlier version of Kerio last year,
but only with my then normal ISP's pop server (I think it may have affected
SMTP too), with kerio running there would be at least a 30 second delay
in my mailserver responding, all my other ISP's mail servers worked fine.
I was too busy to investigate it so I switched firewalls.
 
I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?
Click to expand...

No. Hard to tell what the problem is without looking at the rule set.
Anywau 5-10 seconds delay isnt much.



Aaron
 
YoKenny,
I'm also running Kerio with AVG. However, turning off AVG has no
effect on email access and delivery while turning off Kerio does.
Click to expand...

AFAIK AVG antivirus doesnt directly scan emails downloaded from anything
but outlook, so unlike say AVAST which acts as a mail proxy to your mail
server, AVG shouldnt make a difference to the functioning of the
firewall.

Point 2 of http://blarp.com/faq/faqmanager.cgi?file=kerio_other&toc=kerio

might be useful, though in summary it says you have to bear with it. ;)
I don't see a separate listing for the Mozilla mail/news reader. There
is a listing only for "Mozilla" and the ports it's accessing are:

25 (to access my ISP's email server)
110 (to send out email)

I'm using a fiber optic cable connection rather than a dialup. I've
got the rule for Mozilla set up to allow it to use any port using TCP.
Click to expand...

Might tighten that up a bit.
On the other hand, I have rules set up to block any ICMP (both
outgoing and incoming)
Click to expand...

All types?

and IGMP. I've also disabled incoming TCP and
all UDP to "System".
Click to expand...
I know that the order I have them placed makes a
difference too (top ones take precedence.)
Click to expand...

Yes, and once it matches a rule , it stops.


Aaron
 
Aaron said:
AFAIK AVG antivirus doesnt directly scan emails downloaded from anything
but outlook, so unlike say AVAST which acts as a mail proxy to your mail
server, AVG shouldnt make a difference to the functioning of the
firewall.
Click to expand...

Yeah, I kind of figured on that one. However, I still disabled email
scanning since I don't even have OE installed at this point.
Point 2 of http://blarp.com/faq/faqmanager.cgi?file=kerio_other&toc=kerio
might be useful, though in summary it says you have to bear with it. ;)
Click to expand...

I think this might be the situation. Thanks for pointing out this link
to me.
Might tighten that up a bit.
Click to expand...

Not sure what good that would do. However, I'll look into it.
All types?
Yep.


Yes, and once it matches a rule , it stops.
Click to expand...

Thanks for your input, Aaron.
 
I had a similar problem with an earlier version of Kerio last year,
but only with my then normal ISP's pop server (I think it may have
affected SMTP too), with kerio running there would be at least a 30
second delay in my mailserver responding, all my other ISP's mail
servers worked fine. I was too busy to investigate it so I switched
firewalls.
Click to expand...


This happens when Kerio is not allowing the server to send back it's
verification traffic (for want of a better name) when you poll the POP3
server.

Check your Kerio log, see what it was blocking in from the POP3 server at
the time, and make a rule to allow it.

I can't believe someone junked a firewall because it was too secure. Isn't
that what you want?
 
I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I
nervously turn it off, email sends instantly. But with it running,
there is about a 5-10 second delay. Also, logging on to my email
server takes about 15 seconds with Kerio running. Has anybody else
noticed the same problems?
Click to expand...

John,

That's not a problem with Kerio but with the rules that you are using.
Most likely, your ISP is sending additional packets (other than the
actual sending/receiving of email) that are being blocked and as a
result the server is waiting for a response that never comes. You
should turn on logging in every rule, log on, and try to send as well
as receive an email (e.g., send one to yourself). Then, look at the
log and see what was blocked. Create another rule or rules to allow
that traffic. To make it secure, you might want to restrict those
additional rules to the IP of your ISP (which you can get from the
log). Put those "allow" rules above the ones that blocked the traffic
and there should be no more delays....

Emmanuel
 
I can't believe someone junked a firewall because it was too secure. Isn't
that what you want?
Click to expand...

The FAQ link posted by bassbag seems to cover this issue

http://www.blarp.com/faq/faqmanager.cgi?file=kerio_other&toc=kerio#q2

Sygate, Zonealarm and Kerio all provide adequate security.
Only Kerio had an issue. Yes I could have tried examine the logs and fired up
my packet sniffer but at the time it was more convenient to swap firewalls.

Anyway for me it irrelevant now as the ISP in question is no longer trading,
shame really, it was by far the best and the second cheapest ISP
(only beaten by a totally free one) I have ever used :(
 
John said:
Aaron wrote:

(clipped)

(clipped)
Click to expand...

Aaron, thanks. Your link provided the answer.

Note that in "e)" they mistakenly say "TPF" instead of "KPF" because
Kerio Personal Firewall is an offshoot of "Tiny Personal Firewall".

I did "b)" and now both accessing the server and sending.email is very
fast. However as they warned, this has resulted in my not being able
to operate in "stealth mode." I'm going to try "e)" and have
downloaded the "dummy server" though. As for the "stealth mode" the
same F.A.Q. says the following about it:
_________________________________________________

What is "stealth" mode?

In theory, stealth mode hides all the ports on your computer from
being visible to others on the internet. Some users think this makes
them less vulnerable to a malicious attack and consider it the "holy
grail" of firewall configurations. In my opinion, stealth mode is
overrated for a number of reasons.
# While true that your ports are "invisible", a "stealthed" computer
really looks like a black hole to a hacker. Data goes in but it never
comes out. A good hacker can spot this behavior and may actually
consider it a challenge to try to break in as he/she wonders what's
there. Sometimes, staying in plain sight makes you less attractive as
a target.
# Achieving "stealth" mode with some network configurations (such as
Microsoft Internet Connection Sharing or ICS) can be very difficult.
In fact, stealth mode itself can make it difficult for the networked
computers to "see" and interact with the gateway computer.
# Computers don't stay "stealthed". The moment you do something that
accesses the Internet from your end, you're "unstealthed" because data
is coming out. Any hacker with a packet sniffer who knows where to
look can tell that something's there.

Anyway, there are pros and cons on both sides of this argument. I
recommend you read for yourself and decide whether "stealth" mode is
worth achieving for you. (TG)
_________________________________________________
 
EA said:
John,
That's not a problem with Kerio but with the rules that you are using.
Most likely, your ISP is sending additional packets (other than the
actual sending/receiving of email) that are being blocked and as a
result the server is waiting for a response that never comes. You
should turn on logging in every rule, log on, and try to send as well
as receive an email (e.g., send one to yourself). Then, look at the
log and see what was blocked. Create another rule or rules to allow
that traffic. To make it secure, you might want to restrict those
additional rules to the IP of your ISP (which you can get from the
log). Put those "allow" rules above the ones that blocked the traffic
and there should be no more delays....
Click to expand...

Emmanuel,
It was in fact Kerio. When I turned of "stealth mode" as mentioned
at the link Aaron provided, the problems stopped. This will work for
now, but I intend to try another method which allows stealth mode.
 
Emmanuel,
It was in fact Kerio. When I turned of "stealth mode" as mentioned
at the link Aaron provided, the problems stopped. This will work for
now, but I intend to try another method which allows stealth mode.
Click to expand...

Emmanuel,John

In fact, You both agree. It has to do with the TCP 113 INDENT.

"The way KPF currently is, you cannot expose a single closed port on your
system so that selected servers could get the "closed port" reply back
and not the others. There is a hidden "Packet to unopened port received"
rule you can not configure and which precedes any rule you might create.
This is very inconvenient and painful."

Pity. Another solution I think would be just open your port 113 to that
specific ip.







Aaron
 
Emmanuel,
It was in fact Kerio. When I turned of "stealth mode" as
mentioned
at the link Aaron provided, the problems stopped. This will work
for now, but I intend to try another method which allows stealth
mode.
Click to expand...


John,

Of course the problem stopped when you turned off stealth mode! Try my
suggestion and you might be surprised. It's not a good idea to
sacrifice stealth mode. You can also use telnet to test...

Emmanuel
 
EA said:
John Corliss <[email protected]> typed in



John,
Of course the problem stopped when you turned off stealth mode! Try my
suggestion and you might be surprised. It's not a good idea to
sacrifice stealth mode. You can also use telnet to test...
Click to expand...

Emmanuel,
I already have logging on, so I'll take a look. However,I'm not
really up to speed with configuring Kerio yet.
My understanding is that the ports may be visible, but they're
still closed. As far as stealth mode is concerned, see this link:

http://www.blarp.com/faq/faqmanager.cgi?file=kerio_basic&toc=kerio#q9

I even went totally without a firewall for a long time recently. Must
have been under the radar.
 
Sygate, Zonealarm and Kerio all provide adequate security.
Only Kerio had an issue. Yes I could have tried examine the logs and
fired up my packet sniffer but at the time it was more convenient to
swap firewalls.
Click to expand...


The fact that Sygate and ZA both allowed traffic that Kerio didn't just
bolsters my already strong conviction that you can't beat it. Not only is
it the best free firewall, it's better than most you pay for.

The traffic in question was nothing to be concerned about (a ping from the
POP3 server, essentially) but Kerio did what it should have done, and
disallowed it.
 
Back
Top