IPTable interfering with email.

[Paul Mooring]

Hi,

Iptables is some of the most misunderstood software around.  It isn't actually a service that can be started and stopped, but rather the user interface for the networking filter in the Linux kernel (net filter).  I am curious as to where this config came from and if that's the running config while iptables is "started".  Starting the iptables "service" on nearly all distros just runs the equivalent  of:

    iptables -F
    iptables -t nat -F
    # Maybe flush some more tables if you have any
    source /path/to/some/saved/rules.sh

The command 'iptables-save' will show you the currently running config to see if it differs from your saved config.  Your rules for the most part look like they should be valid for a mail server.  The only irregularity is allowing tcp port 53.  If your server is using it's own IP as a DNS server (not 127.0.0.1 but like 192.168.0.x or something), DNS is generally UDP traffic so it's possible iptables is killing DNS on the server and mx lookups along with it because you have tcp/53 allowed and udp/53 blocked.

--
Paul Mooring
Systems Engineer and Customer Advocate

www.opscode.com

From: keith smith <klsmith2020 at yahoo.com<mailto:klsmith2020 at yahoo.com>>
Reply-To: Main PLUG discussion list <plug-discuss at lists.phxlinux.org<mailto:plug-discuss at lists.phxlinux.org>>
Date: Friday, March 29, 2013 2:12 PM
To: Main PLUG discussion list <plug-discuss at lists.phxlinux.org<mailto:plug-discuss at lists.phxlinux.org>>
Subject: IPTable interfering with email.


Hi,

I am puzzled.

I cannot receive or send email when I have IP table on, except to Yahoo.com.  I get bounded emails when trying to send.

As soon as I stop IPTables I start receiving emails.

CentOS 6.4, Postfix, dovcott, Spamassassin, virtual host server running on my business cox account (no blocked ports).

Router ports that are open 21,22,25,53,80,143,443,587. (port forwarding)

IPTable config:

# Generated by iptables-save v1.4.7 on Fri Mar 29 14:08:56 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [4:432]
-A INPUT -s 192.168.20.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s x.x.x.x/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s x.x.x.x/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Mar 29 14:08:56 2013


Thank you for any insight.
Keith

------------------------
Keith Smith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.phxlinux.org/pipermail/plug-discuss/attachments/20130331/bdcdfe4f/attachment.html>