firewall rule how permit smtp.gmail.com [SOLVED]

[bdario]

Hello to all,
Opnsense 19
I'm experimenting an issue driving me nut:
I would like to send emails from a NAS behind the firewall
The NAS is correctly configured to use smtp.gmail.com:587 and works fine only if I put a rule on the server interface like this one:
- source addres: <NAS.IP.ADDR.ESS/32>
- source port: <ANY>
- destination address: <ANY>
- destination port: <ANY>
Now I would like to shrink the rule specifying "destination address" and "destination port" but the firewall doesn't accept "smtp.gmail.com".
I tried to use the ip address resolving smtp.gmail.com but it doesn't work
Is there a way to use the name instead of the IP in the field "destination address" of the rule?
Thanks so much for your kindly help
best regards
Dario

[chemlud]

You can try an Alias with the smtp server, which you can use in your FW rules.

But even more important than the server is in my opinion to limit the PORT the NAS can connect to.

I would get a little raspberry pi (1b or 2b is sufficient) and set up a local email server, just for receiving status emails from NAS, etc. Why should/would you hand over the details of your network to Google?

[bdario]

Hi chemlud,
alias doesn't solve the issue
Dario

[chemlud]

Hmmm, why? :-)

Did you check that your Alias get's resolved? ..see pftables.

[bdario]

I created and enabled an alias as follow:
- name: gmail
- type: Host(s)
- Description: smtp.gmail.com
- Content: smtp.gmail.com
I tested the alias in: Firewall / Diagnostics / pfTables
It resolves 64.233.184.109
I modified the rule as follow:
- source addres: <NAS.IP.ADDR.ESS/32>
- source port: <ANY>
- destination address: gmail
- destination port: <ANY>
or
- destination port: 587
but it doesn't permit the NAS to send email

[chemlud]

Again: It's more important to limit the destination port than the destination ip.

I see no reason (besides google messing up DNS) why your rule should not work.

[bdario]

so must I assume firewall doesn't work properly?
Hey folks, any suggestion?
Thanks

[bdario]

it seems to be solved
Tracing firewall logs I found an IP responding on tcp 587
query for it whois reply me "google"
add this ip in the alias rule solved the issue
thanks
Dario

[chemlud]

And you hardcoded the IP into your firewall rule now?

I would not bet that the IP resolves to this SMTP server (and other way around) in a month/year...

[siga75]

alias with smtp.gmail.com and rule for port 587 works like a charm for me

I would investigate deeper