Outbound transit SMTP (TCP/25) connections to Public IP Address/FQDN not working with AWS firewall

Why are outbound transit SMTP (TCP/25) connections to Public IP Address/FQDN not working with the AWS firewall?

Example Scenario:

• GP App has been configured with the include domain split-tunneling for a public domain with port TCP 25
• GP App gets the DNS resolution for the public domain and includes the bindings for the resolved public IP address via tunnel 
• GP App forwards the TCP SYN on port 25 to the public destination IP address via VPN Tunnel (IPSec/SSL) to the GP Gateway
• GP Gateway (configured on AWS VM firewall) receives and forwards the TCP SYN to the next hop
• But the firewall never receives the SYN-ACK or response, even after several retransmissions

AWS VM Firewall

PAN-OS

Outbound SMTP on TCP/25 to Public destination

Please check AWS documentation on Restriction on email sent using port 25

By default, Amazon EC2 allows outbound traffic over port 25 only to private IPv4 addresses. Traffic over port 25 is blocked to public IPv4 addresses and IPv6 addresses.

You can request that this restriction be removed. For more information, see How do I remove the restriction on port 25 from my Amazon EC2 instance or Lambda function?

This restriction does not apply to outbound traffic over port 25 destined for:

IP addresses in the primary CIDR block of the VPC in which the originating network interface exists.

IP addresses in the CIDRs defined in RFC 1918, RFC 6598, and RFC 4193.