0

I'm working server Centos 6.5.

I allowed incoming and outgoing traffic for SMTP as below though i'm unable to sent mail from server if iptables are switch on.

My IPtables files rules are as below

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [28:2028]
#Input
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A INPUT -i eth0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -d 0/0 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A INPUT -d 0/0 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -d 0/0 -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW,ESTABLISHED 
-j ACCEPT 
#Output
-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A OUTPUT -s 0/0 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 
-A OUTPUT -s 0/0 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A OUTPUT -s 0/0 -p tcp -m tcp --sport 25 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 
COMMIT

Please advise.

Improve this question
2
  • If this server is a web server, then I see a few glaring security holes in your iptables rules (in addition to the fact that it doesn't allow DNS traffic or setting up new SMTP sessions).
    – Jenny D
    Apr 29, 2014 at 7:12
  • Hi Jenny,I would like to thank you first for your quick reply,I'm a web and mobile developer so don't have deep knowledge about server security.I'm Working on apache & PHP web application.So can you help me which rules i need to apply so that my server willn't compromise in future.I want to allow SSH,SMTP,HTTP,HTTPS,SSL traffic only through my server.I lessen the security because my mails aren't working just now.
    – naitik joshi
    Apr 29, 2014 at 7:25

1 Answer 1

Reset to default
0

You aren't allowing either the outbound SMTP packets or (depending on your DNS configuration) any DNS lookups. Some changes are needed.

Before I go on, do you have a business need to filter outbound traffic, or is that just cargo-cult programming?

Edit: absent any response to that, here's what I think you should do:

  1. Change the policy on the OUTPUT chain to ACCEPT; I don't see any good reason to restrict that traffic

  2. Get rid of all the rules in the OUTPUT chain

  3. Add rules to the INPUT chain that say

    -A INPUT -i eth0 -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT

    -A INPUT -i eth0 -p udp --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

Improve this answer
7
  • Thanks for the reply. This is just an attempt by me to secure our new dedicated web-server and as being web-developer, I am trying to gather what I can from internet. Above firewall rules was result of that.
    – naitik joshi
    Apr 29, 2014 at 7:42
  • I disagree on the OUTPUT chain if you want in-depth security.
    – Jenny D
    Apr 29, 2014 at 7:56
  • I wouldn't object to that. I restrict the OUTPUT chain myself on security core devices, such as firewalls, that have little or no business talking to anyone, only in allowing others to talk. But if I wanted in-depth security for my server, I wouldn't start by overloading some poor web developer with a bunch of sysadmin responsibilities. At the moment, my feeling is the OP is causing him/herself more problems than (s)he's fixing, by restricting OUTPUT traffic.
    – MadHatter
    Apr 29, 2014 at 8:09
  • Thanks guys.I allowed output trafiic by setting up rules like -A OUTPUT -o eth0 -d 0.0.0.0/0 -j ACCEPT
    – naitik joshi
    Apr 29, 2014 at 8:48
  • If that means you've got things working without completely removing your rules, ie we've answered your question, then do consider accepting an answer by clicking the "tick" outline next to it. That's the SF etiquette, and it drives the reputation system both for you and the author of the answer. Also, it stops the question floating around forever like a querulous albatross.
    – MadHatter
    Apr 29, 2014 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .