SNMP trap process with zabbix_trap_receiver.pl localhost test but not external

[b3owu1f]

Greetings fellows,

I've configured snmptrapd and zabbix_trap_receiver.pl as per Zabbix's, blog recommendation.

The tests to localhost with snmptrap command were sucessfuly captured and processed to the temp archive /tmp/zabbix_traps.tmp and are then captured by Zabbix into the 127.0.0.1 Test host's trap item.

However the traps sent by an external device, which I confirmed are arriving to the server in the correct port with wireshark, are not being processed to the temp archive /tmp/zabbix_traps.tmp and therefore not captured by Zabbix into the related host.
I already checked the community name in the device and server files. The server firewall is configured to accept any connections from any to any.

Any ideas on what could have been happening? I can't find any info other than the configurations I already have done and checked.

Here some sample data captured from wireshark:

From external device:
1 0.000000000 192.168.110.130 -> 192.168.104.209 SNMP 428 snmpV2-trap 1.3.6.1.2.1.1.3.0 1.3.6.1.6.3.1.1.4.1.0 1.3.6.1.4.1.28914.5.3.1.101.0 1.3.6.1.4.1.28914.5.3.1.102.0 1.3.6.1.4.1.28914.5.3.1.103.0 1.3.6.1.4.1.28914.5.3.1.104.0 1.3.6.1.4.1.28914.5.3.1.105.0 1.3.6.1.4.1.28914.5.3.1.106.0 1.3.6.1.4.1.28914.5.3.1.107.0 1.3.6.1.4.1.28914.5.3.1.108.0 1.3.6.1.4.1.28914.5.3.1.109.0 1.3.6.1.4.1.28914.5.3.1.110.0 1.3.6.1.4.1.28914.5.3.1.111.0
From loopback test:
1 0.000000000 127.0.0.1 -> 127.0.0.1 SNMP 160 snmpV2-trap 1.3.6.1.2.1.1.3.0 1.3.6.1.6.3.1.1.4.1.0 1.3.6.1.6.3.1.1.5.3

[tim.mooney]

You've verified it works for localhost, verified the remote TRAPer is using the same community and verified it's being received with a packet capture.

You've ruled out most of the standard issues that people have when setting up the trapper.

About the only other thing I can think of is something like SELinux or AppArmor or some other kind of extra security layer. You don't say what distro and version (or Zabbix version), so I can't even guess which of those you should check, but that would be what I would try rule out next.