<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 11.00.9600.18231"></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>Hi Jose,</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>thanks for your effort!</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>What you describe is exact the way I already configued
stunnel & the mail-clients. </SPAN></FONT><FONT color=#0000ff size=2
face=Arial><SPAN class=092152317-31032016>Stopping Avira doesn't make any
difference - e-mails still can be send or recieved.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>tcpview showed me the the listening ports as expected
25,110,143 PLUS two ports above Port 8000 (e.g. 8248 & 8249):
</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>stunnel.exe 6992 TCP 127.0.0.1 25
0.0.0.0 0
LISTENING <BR>stunnel.exe 6992 TCP 127.0.0.1 110
0.0.0.0 0
LISTENING <BR>stunnel.exe 6992 TCP 127.0.0.1 143
0.0.0.0 0
LISTENING <BR>stunnel.exe 6992 TCP 127.0.0.1 8248 127.0.0.1 8249 ESTABLISHED <BR>stunnel.exe 6992 TCP 127.0.0.1 8249 127.0.0.1 8248 ESTABLISHED <BR></SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>BUT what I tried again: Instead of setting
127.0.0.1:port (25,11,143) in the mail-client config, I switched back to
pop3.my-provider.net / imap.my-provider.net / smtp.my-provider.net with no
SSL/TLS/STARTTLS and then Avira is able to scan the
e-mails!!!</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=092152317-31032016>So my suspicion is, that when setting the mail-client
config to 127.0.0.1:port, stunnel gets the e-mails BEFORE Avira and sends them
across the encrypted tunnel (and Avira is again not able to read the traffic
inside that tunnel). </SPAN></FONT><SPAN class=092152317-31032016><FONT
color=#0000ff size=2 face=Arial>So the traffic flow with the
127.0.0.1:port settings is: </FONT><SPAN lang=DE><FONT color=#0000ff size=2
face=Arial>Client -> <SPAN class=092152317-31032016>stunnel
</SPAN>-> <SPAN class=092152317-31032016>Avira (blind)</SPAN> ->
provider</FONT></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=092152317-31032016><SPAN lang=DE><FONT
color=#0000ff size=2 face=Arial></FONT></SPAN></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=092152317-31032016><SPAN lang=DE><FONT
color=#0000ff size=2 face=Arial>I still wonder how I ever got the setup running
successful when the traffic flow really is going that
way.</FONT></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=092152317-31032016><SPAN lang=DE><FONT
color=#0000ff size=2 face=Arial></FONT></SPAN></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=092152317-31032016><SPAN lang=DE><FONT
color=#0000ff size=2 face=Arial>Regards,</FONT></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=092152317-31032016><SPAN lang=DE><FONT
color=#0000ff size=2 face=Arial>Ivan</FONT></SPAN></SPAN></DIV><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px"
dir=ltr>
<DIV lang=de class=OutlookMessageHeader dir=ltr align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>Von:</B> Jose Alf. [mailto:josealf@rocketmail.com]
<BR><B>Gesendet:</B> Donnerstag, 31. M�rz 2016 05:22<BR><B>An:</B>
de_masi@blu-it.de; stunnel-users@stunnel.org<BR><B>Betreff:</B> Re:
[stunnel-users] Incoming port ignored<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV
style="FONT-SIZE: 16px; FONT-FAMILY: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; COLOR: #000; BACKGROUND-COLOR: #fff">
<DIV id=yiv8063601402>
<DIV id=yui_3_16_0_ym18_1_1459389880750_6184>
<DIV id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_2952 dir=ltr>
<DIV id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_2814><BR
clear=none></DIV>
<DIV>Ivan,</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_6682><BR
clear=none><SPAN></SPAN></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_6372 dir=ltr>I checked the references.
It looks like Avira works more or less as Ludolf thinks. Somehow, it
intercepts connections to SMTP, POP3 and IMAP servers. The scan should be
transparent to both mail client and server. If the traffic is encrypted
between client and server, it can't scan it. </DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_6680 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_6572 dir=ltr>Now, a connection can
start in the standard (non-encrypted) ports and it can be upgraded to a secure
one. If this happens, Avira blocks the connection. To avoid this, you must
ensure your mail client communicates only in clear text. This is the crucial
part. No SSL/TLS/STARTTLS allowed.</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7009 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8687 dir=ltr><A
id=yui_3_16_0_ym18_1_1459389880750_8686
href="https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/935">https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/935</A><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8694><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8716><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8681 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7008 dir=ltr>So, I think your
workaround configuration should work. Set your accepts to 127.0.0.1:port
(where port=25,110,143). This blocks connections from other machines to your
stunnel service.</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7729 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7770 dir=ltr>Configure your e-mail
client to send mail via 127.0.0.1:25 and fetch POP3 and IMAP Mail from
127.0.0.1:110 and 127.0.0.1:143 only with no encryption. Note: your mail
client is NOT listening on those ports (stunnel is or will be listening). Your
mail client connects to those ports.<BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7210 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7211 dir=ltr>Test as follows:</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7256 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7277 dir=ltr>1. Disable Avira.</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7368 dir=ltr>2. If you have stunnel in
service mode, make sure it is stopped.<BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7299 dir=ltr>2. Start stunnel in
application mode. Make sure there are no errors. The log should tell you it is
listening on ports 25,110,143. You can also use tcpview utility from
sysinternals (now Microsoft) to verify this.<BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7365 dir=ltr>3. Try sending/receiving
e-mail.</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7833 dir=ltr>4. If this works, enable
Avira and test again.</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7832 dir=ltr>5. Report results.</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7906 dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8655 dir=ltr><BR></DIV>
<DIV dir=ltr><BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7980 dir=ltr>Regards,</DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8565 dir=ltr>Jose<BR></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_7822 dir=ltr><BR></DIV><FONT
id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_3308 size=2 face=Arial>On
Wednesday, March 30, 2016 8:51 AM, Ivan De Masi <de_masi@blu-it.de>
wrote:
<DIV id=yui_3_16_0_ym18_1_1459389880750_8197
class=qtdSeparateBR><BR><BR></DIV></FONT></DIV></DIV></DIV>
<DIV id=yui_3_16_0_ym18_1_1459389880750_8198 class=.yiv8063601402yahoo_quoted>
<DIV id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_2886
style="FONT-SIZE: 16px; FONT-FAMILY: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif">
<DIV id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_2885
style="FONT-SIZE: 16px; FONT-FAMILY: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif">
<DIV class=qtdSeparateBR><BR><BR></DIV>
<DIV id=yiv8063601402yqtfd99070 class=yiv8063601402yqt9329662513><BR
clear=none>
<DIV id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_2945
class=yiv8063601402y_msg_container>I just tell Avira e-mail scanner on which
ports it has to listen (POP3: 110<BR clear=none>/ IMAP: 143 / SMTP: 25).<BR
clear=none>I can't configure any IP - but this is not necessary, because as I
mentioned<BR clear=none>before: When configuring the e-mail client with an
unencrypted and direct<BR clear=none>connection to my mailprovider, Avira is
able to scan the e-mails. So it<BR clear=none>already listens on localhost.<BR
clear=none><BR clear=none>I found that workaround here:<BR clear=none><BR
clear=none><A id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_3307
href="https://answers.avira.com/de/question/avira-email-schutz-blockiert-ssltlssta"
shape=rect rel=nofollow
target=_blank>https://answers.avira.com/de/question/avira-email-schutz-blockiert-ssltlssta</A><BR
clear=none>rttlsverbindung-9253<BR clear=none><BR clear=none>And Outlook &
Thunderbird are listening on 127.0.0.1:110, 127.0.0.1:143,<BR
clear=none>127.0.0.1:25 ... it worked!!! --- WRONG<BR clear=none><BR
clear=none>I think from the moment I installed stunnel as a service problems
started.<BR clear=none>The servive-daemon also told me, that there is no
config (?!).<BR clear=none>So I switched back to the "GUI Start" and now it
doesn't work any more :-/<BR clear=none><BR clear=none>Well, this seem logical
to me, but when I switch off the mail-scanner it<BR clear=none>doesn't
interrupt the fetching or sending, only when I stopt stunnel e-mails<BR
clear=none>can't be fetched or send any more. So it seems to me somehow the
mail-client<BR clear=none>connects directly to stunnel? <BR clear=none><BR
clear=none>> Only the connection stunnel-provider will be encrypted.<BR
clear=none><BR clear=none>Yes, that's right.<BR clear=none><BR
clear=none>Regards,
<DIV id=yiv8063601402yqtfd52062 class=yiv8063601402yqt7267761171><BR
clear=none>Ivan<BR clear=none><BR
clear=none>_______________________________________________<BR
clear=none>stunnel-users mailing list<BR clear=none><A
href="mailto:stunnel-users@stunnel.org" shape=rect rel=nofollow target=_blank
ymailto="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</A><BR
clear=none><A id=yiv8063601402yui_3_16_0_ym18_1_1459352693473_3122
href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users"
shape=rect rel=nofollow
target=_blank>https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</A><BR
clear=none></DIV><BR clear=none><BR clear=none></DIV></DIV></DIV>
<DIV id=yiv8063601402yqtfd39918 class=yiv8063601402yqt9329662513></DIV></DIV>
<DIV id=yiv8063601402yqtfd24523
class=yiv8063601402yqt9329662513></DIV></DIV></DIV></BLOCKQUOTE></BODY></HTML>