POP3 Client Outlook 2003 cannot access e-mail from Gmail through Fedora Core v5

[mxgzhang]

The box is served as a proxy, and has 2 NICs, one is for internal with 192.168.0.x/24, and the other connected to ADSL with 10.1.1.x/24, installed Fedora V5, Squid, DansGuardian.
Clients (winXPs) can access Internet by browsers with no problem. But has problem with Outlook accessing POP based email from internet, like Gmail.
Configured Outlook 2003 based on the instructions from the gmail website, when click “Test Account Settings …”, the result is like this:
Establish Network Connections Completed
Find outgoing mail server (SMTP) Failed
Find incoming mail server (POP3) Failed
Log onto incoming mail server (POP3) Failed
Send test e-mail message Failed

Download and run the Gmail POP Troubleshooter, and get the following result:
Test POP Session
Test SMTP Session
Time Step OK? Details
20:00:01.704704 Resolve FAIL Name pop.gmail.com does not resolve in DNS: Host not foundTest SMTP Session

Time Step OK? Details
20:00:19.591591 Resolve FAIL Name smtp.gmail.com does not resolve in DNS: Host not found

On the fedora box, the Firewall is enabled, with all the check-box in the “Trusted Services” checked (System->Administration->Security Level and Firewall), in the Other Ports box, the following ports of TCP are added, pop3, pop3s, smtps, Squid, webcache. The SELinux is enforced.
No matter the Firewall is enabled or disabled, or SELinux is enforced or disabled, the result from Outlook 2003 are the same.

If using W2K3 with ISA as proxy, there is no problem at all.
Please point me out where the problem is, or where should I look into. I am pretty new to Linux.
Thanks
Mark

[stevea]

It sounds like you don't have DNS setup for the Fedora box.

Can you "dig pop.gmail.com" and get a result ?
Can you "ping google.com" ?
What's in your /etc/resolv.conf when this fails ?
Are you using dhcp on the Internet side interface ?

[mxgzhang]

Thanks Stevea
"Can you "dig pop.gmail.com" and get a result ?" Yes on the Fedora box.
"Can you "ping google.com" ?" Yes on the Fedora box but not on the WinXP box
"What's in your /etc/resolv.conf when this fails ?" It says
; Generated by /sbin/dhclient-script
search domain.invalid
nameserver 10.1.1.1
nameserver 10.1.1.1
"Are you using dhcp on the Internet side interface ?" Yes
It is a W2K3 Network, and the DNS is on a W2K3 DC.

[markkuk]

The standard Fedora firewall setup program isn't useful for setting up a firewall/proxy between two networks, it's intended for client machines only. Install a different firewall configuration program, such as Firestater, fwbuilder or shorewall, or write your own iptables setup script.

[mxgzhang]

But one thing that i do not understand is if I disable the firewall, why the result is still the same?

[markkuk]

Your setup requires NAT to connect the two sides together, and that's done with firewall (iptables) rules. With the firewall turned off or with a firewall setup without NAT the result is the same, no traffic passes through.

[mxgzhang]

I am pretty new with iptables, but i found the following peice by google. if i disalbe the firewall and then put the following in, will it be good enough?
# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

[markkuk]

No. As I said before, you need NAT (or its simpler form, masquerading) not just plain routing. Use one of the front-ends to set up iptables.

[mxgzhang]

I followed the steps from here http://www.howtoforge.com/nat_iptables to setup NAT with no luck. still get no response from "ping google.com". Any idea?

[mxgzhang]

After installing the Firestarter, the DNS Server on the WAN side (from /etc/resolv.conf) can be pinged from client by IP.
Put the DNS Server IP of the WAN into the Forwarders on the DNS Server (the server that does not have ISA), the Internet address can be pinged by using FQDN. And the Outlook functions completely normal now.
Thank you very much.