All right, all done here, the service uses STunnel and is running fine. Time to tell how I've done it.
As one can see by the discussion here it's by no means the only working solution, and probably not even the best one. It's good enough for me and should work for others as well.
1. Get required packages
Required packages are stunnel and ca-certificates. Other than the previous solution, packages xinetd and openssl-util are not needed.
One can install these two required packages with Opkg:
opkg update
opkg install stunnel ca-certificates
If flash space is tight and Opkg runs out of space, Image Builder allows to build a custom image. Like
PACKAGES="luci luci-ssl -ppp -ppp-mod-pppoe -luci-proto-ppp"
PACKAGES+=" stunnel ca-certificates"
make image PROFILE=tplink_tl-wdr3600-v1 PACKAGES="${PACKAGES}"
The result of this build needs to be flashed onto the router.
2. Create configuration
Other than the STunnel coming with Debian, OpenWRT's package is adapted to UCI, its Unified Configuration Interface. Which means, many of the HowTos one can find in the internet don't work without modification. Googling also finds an utterly outdated STunnel man page.
UCI means you don't write a configuration file in /etc/stunnel/stunnel.conf directly. The package installs such a file, but that gets ignored. Instead one writes a file /etc/config/stunnel, in UCI syntax. Like this:
config globals globals
# Drop privileges.
option setuid nobody
option setgid nogroup
# This one gets ignored:
#option foreground yes
# Don't log to stderr, use syslog.
option syslog yes
# Services
config service pop2pops
option client yes
option accept_host 10.0.0.1
option accept_port 100
list connect mail.example.com:995
option verifyChain yes
option CApath /etc/ssl/certs
option checkHost mail.example.com
option OCSPaia yes
A few remarks:
- STunnel's defaults are unsafe. Better uses see here.
- STunnel is a bit unusual as it has no command line options. Not even global temporary things like e.g.
--foreground.
- If you want to run multiple forwarders, simply add multiple
service sections, each with a unique name.
- Keyword
accept_host is crucial and should be the LAN interface of the router. For me that's 10.0.0.1, more typical would be 192.168.0.1. Without that keyword, STunnel listens on all interfaces, including the public/WAN one. This would open unencrypted public access to that mailserver.
- Keywords
verifyChain and CApath (or CAfile) are also crucial. Without them, STunnel doesn't verify these SSL connections and simply accepts every offered certificate.
- Keywords
checkHost and OCSPaia add checking of certificate revocations.
3. Start with the new configuration
That's easy:
/etc/init.d/stunnel restart
4. Tests
As always, one should test the work.
a) Verify the used configuration. UCI creates a configuration file for STunnel, in STunnel's systax, on the fly. With the service started, one can find it in /tmp/etc/stunnel.conf. It should match the intention above:
; STunnel configuration file generated by uci
; Written Wed Jan 7 18:00:53 2026
foreground = quiet
pid = /var/run/stunnel/stunnel.pid
syslog = yes
setgid = nogroup
setuid = nobody
[pop2pops]
CApath = /etc/ssl/certs
client = yes
OCSPaia = yes
verifyChain = yes
checkHost = mail.example.com
connect = mail.example.com:995
accept = 10.0.0.1:100
b) Check Syslog. Browse to Luci -> Menu -> Status -> System Log and filter for stunnel. There should be notifications about STunnel's startup and no errors.
c) Establish a manual connection. As this needs no TLS/SSL, a simple Telnet from any computer in the LAN should say hello to the intended mail server (type QUIT to end the connection):
~$ telnet gate 100
Trying 10.0.0.1...
Connected to gate.
Escape character is '^]'.
+OK POP server ready
QUIT
+OK POP server signing off
Connection closed by foreign host.
d) Test public access. Do the same as above, but with your router's public IP address. The result should be different:
~$ telnet 172.217.208.102 100
Trying 172.217.208.102...
telnet: Unable to connect to remote host: Connection refused
5. References
In addition to the pages linked above, these pages were helpful and should help in case of trouble:
https://www.stunnel.org/static/stunnel.html
https://www.stunnel.org/auth.html
Many thanks to everybody helping here. Much appreciated.