Problem with Kerio.

[John Corliss]

I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?

 

[YoKenny]

I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?

I am running Kerio with AVG and I do not notice any delays with them on.
What rules do you have for the email client? I believe that it needs
access to ports 25 SMTP, 110 POP3, 119 NNTP and 113 IDENT. The way I find
this is to enable the alert for the "Block all" rule and the rule for the
email client and look at the alerts. There may be a logging function in
the email client that you can enable.

 

[John Corliss]

I am running Kerio with AVG and I do not notice any delays with them on.
What rules do you have for the email client? I believe that it needs
access to ports 25 SMTP, 110 POP3, 119 NNTP and 113 IDENT. The way I find
this is to enable the alert for the "Block all" rule and the rule for the
email client and look at the alerts. There may be a logging function in
the email client that you can enable.

YoKenny,
I'm also running Kerio with AVG. However, turning off AVG has no
effect on email access and delivery while turning off Kerio does.

I don't see a separate listing for the Mozilla mail/news reader. There
is a listing only for "Mozilla" and the ports it's accessing are:

25 (to access my ISP's email server)
110 (to send out email)

I'm using a fiber optic cable connection rather than a dialup. I've
got the rule for Mozilla set up to allow it to use any port using TCP.
On the other hand, I have rules set up to block any ICMP (both
outgoing and incoming) and IGMP. I've also disabled incoming TCP and
all UDP to "System". I know that the order I have them placed makes a
difference too (top ones take precedence.)

I'm new at this stuff, so there are undoubtedly mistakes that I've
made. Guess I should really take this to:

 

[bassbag]

I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?

Dont know if youve seen this site but theres quite a few rules for kerio
there plus info,that might help.
http://www.blarp.com/faq/faqmanager.cgi?toc=kerio
me

 

[Mel]

I had a similar problem with an earlier version of Kerio last year,
but only with my then normal ISP's pop server (I think it may have affected
SMTP too), with kerio running there would be at least a 30 second delay
in my mailserver responding, all my other ISP's mail servers worked fine.
I was too busy to investigate it so I switched firewalls.

 

[Aaron]

I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I nervously
turn it off, email sends instantly. But with it running, there is
about a 5-10 second delay. Also, logging on to my email server takes
about 15 seconds with Kerio running. Has anybody else noticed the same
problems?

No. Hard to tell what the problem is without looking at the rule set.
Anywau 5-10 seconds delay isnt much.



Aaron

 

[Aaron]

YoKenny,
I'm also running Kerio with AVG. However, turning off AVG has no
effect on email access and delivery while turning off Kerio does.

AFAIK AVG antivirus doesnt directly scan emails downloaded from anything
but outlook, so unlike say AVAST which acts as a mail proxy to your mail
server, AVG shouldnt make a difference to the functioning of the
firewall.

Point 2 of http://blarp.com/faq/faqmanager.cgi?file=kerio_other&toc=kerio

might be useful, though in summary it says you have to bear with it.

I don't see a separate listing for the Mozilla mail/news reader. There
is a listing only for "Mozilla" and the ports it's accessing are:

25 (to access my ISP's email server)
110 (to send out email)

I'm using a fiber optic cable connection rather than a dialup. I've
got the rule for Mozilla set up to allow it to use any port using TCP.

Might tighten that up a bit.

On the other hand, I have rules set up to block any ICMP (both
outgoing and incoming)

All types?

and IGMP. I've also disabled incoming TCP and
all UDP to "System".

I know that the order I have them placed makes a
difference too (top ones take precedence.)

Yes, and once it matches a rule , it stops.


Aaron

 

[John Corliss]

AFAIK AVG antivirus doesnt directly scan emails downloaded from anything
but outlook, so unlike say AVAST which acts as a mail proxy to your mail
server, AVG shouldnt make a difference to the functioning of the
firewall.

Yeah, I kind of figured on that one. However, I still disabled email
scanning since I don't even have OE installed at this point.

Point 2 of http://blarp.com/faq/faqmanager.cgi?file=kerio_other&toc=kerio
might be useful, though in summary it says you have to bear with it.

I think this might be the situation. Thanks for pointing out this link
to me.

Might tighten that up a bit.

Not sure what good that would do. However, I'll look into it.

All types?
Yep.


Yes, and once it matches a rule , it stops.

Thanks for your input, Aaron.

 

[John Corliss]

Dont know if youve seen this site but theres quite a few rules for kerio
there plus info,that might help.
http://www.blarp.com/faq/faqmanager.cgi?toc=kerio
me

Thanks. And as Aaron pointed out, that F.A.Q. specifically addressed
my problem most likely.

 

[donut]

I had a similar problem with an earlier version of Kerio last year,
but only with my then normal ISP's pop server (I think it may have
affected SMTP too), with kerio running there would be at least a 30
second delay in my mailserver responding, all my other ISP's mail
servers worked fine. I was too busy to investigate it so I switched
firewalls.

This happens when Kerio is not allowing the server to send back it's
verification traffic (for want of a better name) when you poll the POP3
server.

Check your Kerio log, see what it was blocking in from the POP3 server at
the time, and make a rule to allow it.

I can't believe someone junked a firewall because it was too secure. Isn't
that what you want?

 

[EA]

I'm using ver. 2.1.5. Has anybody else noticed that sending and
receiving email is much slower with Kerio running? When I
nervously turn it off, email sends instantly. But with it running,
there is about a 5-10 second delay. Also, logging on to my email
server takes about 15 seconds with Kerio running. Has anybody else
noticed the same problems?

John,

That's not a problem with Kerio but with the rules that you are using.
Most likely, your ISP is sending additional packets (other than the
actual sending/receiving of email) that are being blocked and as a
result the server is waiting for a response that never comes. You
should turn on logging in every rule, log on, and try to send as well
as receive an email (e.g., send one to yourself). Then, look at the
log and see what was blocked. Create another rule or rules to allow
that traffic. To make it secure, you might want to restrict those
additional rules to the IP of your ISP (which you can get from the
log). Put those "allow" rules above the ones that blocked the traffic
and there should be no more delays....

Emmanuel

 

[Mel]

I can't believe someone junked a firewall because it was too secure. Isn't
that what you want?

The FAQ link posted by bassbag seems to cover this issue

http://www.blarp.com/faq/faqmanager.cgi?file=kerio_other&toc=kerio#q2

Sygate, Zonealarm and Kerio all provide adequate security.
Only Kerio had an issue. Yes I could have tried examine the logs and fired up
my packet sniffer but at the time it was more convenient to swap firewalls.

Anyway for me it irrelevant now as the ISP in question is no longer trading,
shame really, it was by far the best and the second cheapest ISP
(only beaten by a totally free one) I have ever used

 

[John Corliss]

Aaron wrote:

(clipped)

(clipped)

Aaron, thanks. Your link provided the answer.

Note that in "e)" they mistakenly say "TPF" instead of "KPF" because
Kerio Personal Firewall is an offshoot of "Tiny Personal Firewall".

I did "b)" and now both accessing the server and sending.email is very
fast. However as they warned, this has resulted in my not being able
to operate in "stealth mode." I'm going to try "e)" and have
downloaded the "dummy server" though. As for the "stealth mode" the
same F.A.Q. says the following about it:
_________________________________________________

What is "stealth" mode?

In theory, stealth mode hides all the ports on your computer from
being visible to others on the internet. Some users think this makes
them less vulnerable to a malicious attack and consider it the "holy
grail" of firewall configurations. In my opinion, stealth mode is
overrated for a number of reasons.
# While true that your ports are "invisible", a "stealthed" computer
really looks like a black hole to a hacker. Data goes in but it never
comes out. A good hacker can spot this behavior and may actually
consider it a challenge to try to break in as he/she wonders what's
there. Sometimes, staying in plain sight makes you less attractive as
a target.
# Achieving "stealth" mode with some network configurations (such as
Microsoft Internet Connection Sharing or ICS) can be very difficult.
In fact, stealth mode itself can make it difficult for the networked
computers to "see" and interact with the gateway computer.
# Computers don't stay "stealthed". The moment you do something that
accesses the Internet from your end, you're "unstealthed" because data
is coming out. Any hacker with a packet sniffer who knows where to
look can tell that something's there.

Anyway, there are pros and cons on both sides of this argument. I
recommend you read for yourself and decide whether "stealth" mode is
worth achieving for you. (TG)
_________________________________________________

 

[John Corliss]

John,
That's not a problem with Kerio but with the rules that you are using.
Most likely, your ISP is sending additional packets (other than the
actual sending/receiving of email) that are being blocked and as a
result the server is waiting for a response that never comes. You
should turn on logging in every rule, log on, and try to send as well
as receive an email (e.g., send one to yourself). Then, look at the
log and see what was blocked. Create another rule or rules to allow
that traffic. To make it secure, you might want to restrict those
additional rules to the IP of your ISP (which you can get from the
log). Put those "allow" rules above the ones that blocked the traffic
and there should be no more delays....

Emmanuel,
It was in fact Kerio. When I turned of "stealth mode" as mentioned
at the link Aaron provided, the problems stopped. This will work for
now, but I intend to try another method which allows stealth mode.

 

[Aaron]

Emmanuel,
It was in fact Kerio. When I turned of "stealth mode" as mentioned
at the link Aaron provided, the problems stopped. This will work for
now, but I intend to try another method which allows stealth mode.

Emmanuel,John

In fact, You both agree. It has to do with the TCP 113 INDENT.

"The way KPF currently is, you cannot expose a single closed port on your
system so that selected servers could get the "closed port" reply back
and not the others. There is a hidden "Packet to unopened port received"
rule you can not configure and which precedes any rule you might create.
This is very inconvenient and painful."

Pity. Another solution I think would be just open your port 113 to that
specific ip.







Aaron

 

[EA]

Emmanuel,
It was in fact Kerio. When I turned of "stealth mode" as
mentioned
at the link Aaron provided, the problems stopped. This will work
for now, but I intend to try another method which allows stealth
mode.

John,

Of course the problem stopped when you turned off stealth mode! Try my
suggestion and you might be surprised. It's not a good idea to
sacrifice stealth mode. You can also use telnet to test...

Emmanuel

 

[bassbag]

Thanks. And as Aaron pointed out, that F.A.Q. specifically addressed
my problem most likely.

you may be intrested in this site ( posted at firewall group)that
contains some kerio presets.
http://geocities.com/yosponge/updates.html
me

 

[John Corliss]

John Corliss <[email protected]> typed in



John,
Of course the problem stopped when you turned off stealth mode! Try my
suggestion and you might be surprised. It's not a good idea to
sacrifice stealth mode. You can also use telnet to test...

Emmanuel,
I already have logging on, so I'll take a look. However,I'm not
really up to speed with configuring Kerio yet.
My understanding is that the ports may be visible, but they're
still closed. As far as stealth mode is concerned, see this link:

http://www.blarp.com/faq/faqmanager.cgi?file=kerio_basic&toc=kerio#q9

I even went totally without a firewall for a long time recently. Must
have been under the radar.

 

[donut]

Sygate, Zonealarm and Kerio all provide adequate security.
Only Kerio had an issue. Yes I could have tried examine the logs and
fired up my packet sniffer but at the time it was more convenient to
swap firewalls.

The fact that Sygate and ZA both allowed traffic that Kerio didn't just
bolsters my already strong conviction that you can't beat it. Not only is
it the best free firewall, it's better than most you pay for.

The traffic in question was nothing to be concerned about (a ping from the
POP3 server, essentially) but Kerio did what it should have done, and
disallowed it.

 

[donut]

Pity. Another solution I think would be just open your port 113 to that
specific ip.

That's exactly what you do.