[GH-ISSUE #5130] frp tunneling for synology mail plus server by passes authentication

gitea-mirror commented

2026-05-05 14:32:59 -06:00

Owner

Copy link

Originally created by @last-Programmer on GitHub (Jan 16, 2026).
Original GitHub issue: https://github.com/fatedier/frp/issues/5130

Bug Description

When we are tunneling smtp ports 25, 465, 587 to synology mail plus server we can send semtp messages without authentication and the mail is relayed

Here is the problem report

https://community.synology.com/enu/forum/1/post/195544

Is there anyway we can overcome this?

frpc Version

0.66.0

frps Version

0.66.0

System Architecture

linux/amd64

Configurations

proxied 25, 465 and 587 ports

Logs

No response

Steps to reproduce

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @last-Programmer on GitHub (Jan 16, 2026). Original GitHub issue: https://github.com/fatedier/frp/issues/5130 ### Bug Description When we are tunneling smtp ports 25, 465, 587 to synology mail plus server we can send semtp messages without authentication and the mail is relayed Here is the problem report https://community.synology.com/enu/forum/1/post/195544 Is there anyway we can overcome this? ### frpc Version 0.66.0 ### frps Version 0.66.0 ### System Architecture linux/amd64 ### Configurations proxied 25, 465 and 587 ports ### Logs _No response_ ### Steps to reproduce ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror closed this issue

2026-05-05 14:33:00 -06:00

gitea-mirror commented

2026-05-05 14:33:02 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Jan 20, 2026):

frp is a transparent TCP proxy and does not implement or bypass SMTP authentication itself. If unauthenticated relaying becomes possible only when exposing SMTP ports via frp, it usually indicates the backend SMTP service treats the proxied connection as “trusted/internal” (e.g., based on source IP/network) and allows relay without AUTH. Please review Synology Mail Plus relay/auth policies (disable open relay, require SMTP AUTH for submission, restrict relay to authenticated users) and add network controls on the frps side (firewall / IP allowlist / avoid exposing port 25 publicly).

@fatedier commented on GitHub (Jan 20, 2026): frp is a transparent TCP proxy and does not implement or bypass SMTP authentication itself. If unauthenticated relaying becomes possible only when exposing SMTP ports via frp, it usually indicates the backend SMTP service treats the proxied connection as “trusted/internal” (e.g., based on source IP/network) and allows relay without AUTH. Please review Synology Mail Plus relay/auth policies (disable open relay, require SMTP AUTH for submission, restrict relay to authenticated users) and add network controls on the frps side (firewall / IP allowlist / avoid exposing port 25 publicly).

gitea-mirror commented

2026-05-05 14:33:03 -06:00

Author

Owner

Copy link

@last-Programmer commented on GitHub (Jan 20, 2026):

Thank you for the reply. It seems to be that it is an issue with synology mail plus server. since frpc is connecting to smtp server from localhost it is being treated as trusted and sends the mail. I tried sending real ip with transport.proxyProtocolVersion = "v2" and synology mail plus server does not like it. it is failing to send the mails. I have contacted synology support in regard to this.

@last-Programmer commented on GitHub (Jan 20, 2026): Thank you for the reply. It seems to be that it is an issue with synology mail plus server. since frpc is connecting to smtp server from localhost it is being treated as trusted and sends the mail. I tried sending real ip with transport.proxyProtocolVersion = "v2" and synology mail plus server does not like it. it is failing to send the mails. I have contacted synology support in regard to this.

gitea-mirror referenced this issue

2026-05-05 14:50:43 -06:00

[PR #4013] [MERGED] update golangci-lint version to 1.56 #4891

No Branch/Tag specified