My home server is running postfix, and is configured to send out monitoring emails (I don’t need to receive there). This worked fine until I installed OpenVPN. Whenever the VPN is ON, the server can reach anything on the Internet, but emails are queued. If I turn off the VPN and flush the queue, everything is sent and I can see the alerts in my mailbox.
I reached out to my VPN provider – ProtonVPN – and they confirmed they are not doing anything to block email traffic. So there is something wrong with my postfix configuration and I need help pinning it down.
I see these entries in my logs when the VPN is ON
root@home-server:~# journalctl -r -t postfix/smtp
Apr 19 11:17:00 home-server postfix/smtp[482862]: 2FDEA113: to=<home-server@remote-server.com>, orig_to=<root>, relay=mail.remote-server.com[62.XXX.XXX.XXX]:25, delay=252420, delays=252400/0.03/20/0, dsn=4.4.2, status=deferred (lost connection with mail.remote-server.com[62.XXX.XXX.XXX] while receiving the initial server greeting)
Apr 19 11:17:00 home-server postfix/smtp[482861]: 0B99D108: to=<home-server@remote-server.com>, orig_to=<root>, relay=mail.remote-server.com[62.XXX.XXX.XXX]:25, delay=277619, delays=277599/0.03/20/0, dsn=4.4.2, status=deferred (lost connection with mail.remote-server.com[62.XXX.XXX.XXX] while receiving the initial server greeting)
Apr 19 11:07:01 home-server postfix/smtp[482089]: E6A32137: to=<home-server@remote-server.com>, orig_to=<root>, relay=mail.remote-server.com[62.XXX.XXX.XXX]:25, delay=46620, delays=46600/0.04/20/0, dsn=4.4.2, status=deferred (lost connection with mail.remote-server.com[62.XXX.XXX.XXX] while receiving the initial server greeting)
My resolver. The 1st entry is removed when the VPN is OFF
root@home-server:~# cat /etc/resolv.conf
# Generated by resolvconf
nameserver 10.96.0.1
nameserver 192.168.50.1
The aliases
root@home-server:~# cat /etc/aliases
# /etc/aliases
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root
munin: root
root: home-server@remote-server.com
My network interfaces. tun0 disappears when the VPN is OFF. But its address changes whenever I reboot or restart the VPN service. enp3s0 always has the same address though because I forced the router to always give that IP to that machine. Not sure if I can/should do the same for the VPN.
root@home-server:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether f0:2f:74:cf:60:34 brd ff:ff:ff:ff:ff:ff
altname enxf02f74cf6034
inet 192.168.50.5/24 brd 192.168.50.255 scope global dynamic enp3s0
valid_lft 66758sec preferred_lft 66758sec
inet6 fe80::f22f:74ff:fecf:6034/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever
22: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.96.0.53/16 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::567a:2f6:ca3a:32da/64 scope link stable-privacy proto kernel_ll
valid_lft forever preferred_lft forever
Postfix main.cf. I tried to add 10.96.0.53/16 (from the tun0 interface above) to the mynetworks parameter, but this did not solve the issue
root@home-server:~# cat /etc/postfix/main.cf
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
#delay_warning_time = 4h
#readme_directory = /usr/share/doc/postfix
compatibility_level = 3.6
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level=may
smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = home-server.local
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = home-server.local, localhost.home-server.local, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
cyrus_sasl_config_path = /etc/postfix/sasl
Postfix master.cf
root@home-server:~# cat /etc/postfix/master.cf
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
#smtp inet n - y - 1 postscreen
#smtpd pass - - y - - smtpd
#dnsblog unix - - y - 0 dnsblog
#tlsproxy unix - - y - 0 tlsproxy
# Choose one: enable submission for loopback clients only, or for any client.
#127.0.0.1:submission inet n - y - - smtpd
#submission inet n - y - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes
# -o smtpd_reject_unlisted_recipient=no
# Instead of specifying complex smtpd_<xxx>_restrictions here,
# specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
# here, and specify mua_<xxx>_restrictions in main.cf (where
# "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
# -o smtpd_client_restrictions=
# -o smtpd_helo_restrictions=
# -o smtpd_sender_restrictions=
# -o smtpd_relay_restrictions=
# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
# Choose one: enable submissions for loopback clients only, or for any client.
#127.0.0.1:submissions inet n - y - - smtpd
#submissions inet n - y - - smtpd
# -o syslog_name=postfix/submissions
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# Instead of specifying complex smtpd_<xxx>_restrictions here,
# specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
# here, and specify mua_<xxx>_restrictions in main.cf (where
# "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
# -o smtpd_client_restrictions=
# -o smtpd_helo_restrictions=
# -o smtpd_sender_restrictions=
# -o smtpd_relay_restrictions=
# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - y - - qmqpd
pickup unix n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
-o syslog_name=postfix/$service_name
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
postlog unix-dgram n - n - 1 postlogd
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
I can add the OpenVPN conf if anyone suspect the issue is there. Other details that might be relevant
root@home-server:~# cat /etc/debian_version
13.4
root@home-server:~# openvpn --version
OpenVPN 2.6.14 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
DCO version: N/A
Originally developed by James Yonan
Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
Compile time defines: <TOO LONG AND NOT USEFUL>
root@home-server:~# postconf -d mail_version
mail_version = 3.10.5
Edit:
Home-server is configured to be an OpenVPN client (nothing connects to it from outside the LAN)
root@home-server:~# ls -lrt /etc/openvpn/
total 12
-rwxr-xr-x 1 root root 1468 Apr 2 2025 update-resolv-conf
drwxr-xr-x 2 root root 4096 Apr 2 2025 server
drwxr-xr-x 2 root root 4096 Apr 15 14:27 client
lrwxrwxrwx 1 root root 39 Apr 15 15:28 protonvpn.conf -> /etc/protonvpn/no-69.protonvpn.udp.ovpn
root@home-server:~# cat /etc/protonvpn/no-69.protonvpn.udp.ovpn
client
dev tun
proto udp
remote 95.XXX.XXX.XXX 80
remote 95.XXX.XXX.XXX 51820
remote 95.XXX.XXX.XXX 5060
remote 95.XXX.XXX.XXX 1194
remote 95.XXX.XXX.XXX 4569
remote-random
resolv-retry infinite
nobind
cipher AES-256-GCM
setenv CLIENT_CERT 0
tun-mtu 1500
mssfix 0
persist-key
persist-tun
reneg-sec 0
remote-cert-tls server
auth-user-pass /etc/protonvpn/auth.txt
auth-nocache
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
<ca>
-----BEGIN CERTIFICATE-----
<RE$DACTED>
-----END CERTIFICATE-----
</ca>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
<REDACTED>
-----END OpenVPN Static key V1-----
</tls-crypt>
I did not set any routing rules in the firewall
root@home-server:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
I control the mail-server. I did not set any routing/firewall rules there. The only ones I see are the ones set by fail2ban. The VPN exit node IP is not blocked by fail2ban
root@remote-server:# nft list ruleset
table inet f2b-table {
set addr-set-sshd {
type ipv4_addr
elements = { <REDACTED> }
}
set addr-set-nginx-bad-request {
type ipv4_addr
elements = { <REDACTED> }
}
set addr-set-postfix {
type ipv4_addr
elements = { <REDACTED> }
}
set addr-set-named-refused {
type ipv4_addr
elements = { <REDACTED> }
}
set addr-set-authelia {
type ipv4_addr
elements = { <REDACTED> }
}
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
meta l4proto tcp ip saddr @addr-set-nginx-bad-request reject with icmp port-unreachable
meta l4proto tcp ip saddr @addr-set-postfix reject with icmp port-unreachable
meta l4proto tcp ip saddr @addr-set-named-refused reject with icmp port-unreachable
meta l4proto tcp ip saddr @addr-set-authelia reject with icmp port-unreachable
}
I can send emails with the command line when the VPN is OFF. Mails are queue when it is ON.
If I telnet to the remote server
With the VPN OFF:
my-user@home-server:/var/log$ telnet 62.XXX.XXX.XXX 25
Trying 62.XXX.XXX.XXX...
Connected to 62.XXX.XXX.XXX.
Escape character is '^]'.
220 mail.remote-server.com ESMTP Postfix (Debian)
q
500 5.5.2 Error: command not recognized
.
221 2.7.0 Error: I can break rules, too. Goodbye.
Connection closed by foreign host.
Postfix sends a response. The logs on the remote-server look like this
2026-04-19T14:47:21.625970+02:00 remote-server postfix/smtpd[14435]: connect from hari-XXX.XXX.XXX.net[82.XXX.XXX.XXX]
2026-04-19T14:47:31.154180+02:00 remote-server postfix/smtpd[14435]: warning: non-SMTP command from hari-XXX.XXX.XXX.net[82.XXX.XXX.XXX]: .
2026-04-19T14:47:31.154392+02:00 remote-server postfix/smtpd[14435]: disconnect from hari-XXX.XXX.XXX.net[82.XXX.XXX.XXX] unknown=0/2 commands=0/2
If I put the VPN ON and telnet again, I do NOT get a response from postfix. The remote-server logs remain empty (mail.log, syslog, fail2ban.log…).
I also tried a traceroute
With VPN OFF
my-user@home-server:/var/log$ tracepath mail.remote-server.com
1?: [LOCALHOST] pmtu 1500
1: RT-AX86U-4858 1.629ms
1: RT-AX86U-4858 1.624ms
2: no reply
3: 80.XXX.XXX.XXX 14.717ms
4: no reply
5: no reply
6: host-62-XXX.XXX.XXX.net 23.871ms
7: adm-b3-link.XXX.XXX.XXX.net 26.029ms asymm 11
8: adm-bb2-link.XXX.XXX.XXX.net 25.033ms asymm 10
9: prs-bb1-link.XXX.XXX.XXX.net 27.857ms asymm 10
10: prs-b6-link.XXX.XXX.XXX.net 28.238ms asymm 11
11: scale.XXX.XXX.XXX.net 25.526ms asymm 13
12: 51.XXX.XXX.XXX 27.135ms asymm 13
13: 51.XXX.XXX.XXX 27.322ms
14: mail.remote-server.com 31.224ms reached
With VPN ON
my-user@home-server:/var/log$ tracepath mail.remote-server.com
1?: [LOCALHOST] pmtu 1420
1: 10.2.0.1 24.671ms
1: 10.2.0.1 23.478ms
2: 190.XXX.XXX.XXX 25.413ms
3: no reply
4: no reply
5: 195.XXX.XXX.XXX 26.027ms
6: 51.XXX.XXX.XXX 34.925ms
7: 195.XXX.XXX.XXX 37.103ms
8: pni-tXXX.XXX.XXX.eu 39.221ms
9: 51.XXX.XXX.XXX 42.117ms
10: mail.remote-server.com 40.549ms reached
