iPhones cannot send emails (but can receive just fine). Trying to get sending emails to work.

Question

With our iPhones connected to our home XG network, we cannot send emails (but we do receive emails just fine). What can I do so we can send emails? 
 If I connect to my VPN, use LTE or use my work Wifi, my iPhone can send emails just fine. 
 I have a pretty much "out of the box" XG setup and this is a recent XG installation. 
 This is the message on the iPhone that we get when we try to send from our home network with XG firewall:

David Birdsall · Accepted Answer

Hua Lin, 
 Hau Lin said: What should I do now so that my system is secure but still allows my desired emails to go in and out of the firewall? 
 Well, this is up to you. But first, you need to understand that most web servers are now communicate with clients through encryption. The servers of Google, Facebook, Apple, Amazon, Wikipedia, and your Email provider use encrypted communication. Even this Sophos site is using encryption. 
 This is great in that it secures the communication between server and your device, but it is also bad for managing network security. By default, the XG Firewall and the firewalls of other vendors do not scan encrypted traffic. They only scan unencrypted traffic. Your firewall can still read the header of encrypted packets to ensure an application/service isn't sending data to a bad site and to prevent a malicious site from sending data in. Your firewall can't read the data in the encrypted packets, so malware can still bypass your firewall as it often does from your email server to your email client. 
 In most networks today, encrypted traffic isn't scanned until it reaches an end point. Today, End Point security does more scanning of traffic than firewalls. Because of this, you are have three options for your XG Firewall: 1. Set your firewall to decrypt and scan your traffic. 2. Allow encrypted data to pass and use the XG Firewall to manage traffic in other ways. 3. Coordinate your firewall with your End Points. 
 Regardless of the brand of firewall one chooses, most people end up doing Option 2 by default without knowing it. I've walked into many costly projects and found where experts thought they were scanning all traffic, but they were only scanning unencrypted traffic. Even if you know about this issue, Option 1 is difficult and time consuming to deploy, even for those who do it every day. Option 3 is a rare option. Sophos is one of the few companies that provides Synchronized Security , and Sophos makes it very easy to deploy and manage. 
 For now, I recommend you focus on Option 2 as it is easy to do. Option two, has two steps. The first step is to deploy a good reliable End Point protection on your End Points. Sophos Home is a good option, but you can use whatever vendor like. The second step is to set up the other security functions of your firewall (Intrusion Prevention, Web Filtering, Application Control, and Secure Wi-Fi). These functions will prevent unwanted traffic from crossing your firewall, so you can eliminate a lot of unnecessary traffic from potentially bringing in malware or sending out your data. Which function you choose and their settings are dependent upon your tastes and needs. Sophos Secure Wi-fi requires the purchase of Wi-Fi Access Points from Sophos. Secure Wi-Fi Access Points use your XG Firewall as a controller to coordinate security and ensure that guest devices and your own mobile devices don't release malware when they connect to your network behind the firewall. 
 If you want to do Option 3, it's easy. You can add Option 3 at any time. You just need to purchase End Point Protection or Intercept X which comes with End Point Protection. Option 3 will include all the settings you deployed in Option 2 with the exception that you will replace the end point security on your end points. End Point Protection will coordinate with your XG Firewall through Sophos Central . 
 I hope this helps.

Deo Angelo Lim · Answer

It means that you are not using any application filter policy. It should be working fine. What can I do for you is to create a firewall rule that allows all traffic for the iphone you are currently having a problem for testing purposes. 
 
 Warm Regards,

Aditya Patel · Answer

Hi Hau , 
 If you have configured the firewall from scratch then you have to disable the rule which was created by default. 
 This may cause issue with SMTP connection, let us know if that does not work out. 
 If not I have observed you have application filter in place. Choose all policy to Allow All and check if that would work . This would give you an idea, where the connection issue occurs.

David Birdsall · Answer

Hua Lin, 
 
 In left Column, click Protect > Firewall: You should see the Firewall screeen 
 Disable Firewall Rule named "Auto added firewall policy for MTA": Click on the ... in the circle and click the ON switch to Off. 
 You will see a popup window asking "Are you sure you want to disable the Firewall Rule?": Click OK. 
 
 That's It. Problem Solved! 
 Have a Good Day. 
 David