Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a single server that functions as both a mail and web server. I'd like to use iptables to permit all incoming and outgoing connections, except to incoming port 25. I only want one remote host to be able to connect to port 25 (in order to relay mail).

Essentially, I'd like a wide open server without turning it into a spam relay. Any suggestions? Thanks!

share|improve this question
up vote 8 down vote accepted

That sounds like a fairly straightforward request. Having said that, I'm still a little squeamish about telling somebody to configure their SMTP server as a wide-open relay. You Even if you're limiting the incoming connections to the machine you really should be using some kind of authentication to control relaying. Even consumer ISPs don't allow unauthenticated relaying from inside their networks anymore.

Assuming your INPUT chain is set to an "ACCEPT" policy and currently allows new incoming packets to fall off the end of the chain, just do:

iptables -A INPUT -p tcp --dport 25 -s ! x.x.x.x -j DROP

For completeness, my initial answer looked like:

iptables -A INPUT -p tcp --dport 25 -s x.x.x.x -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

The first method has the economy of using a single rule and being very easy to visually parse, since it's all self-contained. The second is easier to add additional addresses to.

Substitute the source address for "x.x.x.x". I suspect that you really want more than just once source, but you can figure that out. (You probably have machines on your LAN or other clients that you want to talk to it to-- but perhaps not.)

(Hopefully you've got rules at the top of your INPUT chain to allow established connections to shortcut the rest of the chain and just ACCEPT. You really don't want anything but the initial handshake hitting the rules above.)

Obviously, save those rules in whatever iptables state-persisting contrivance your distribution uses.

Edit: Thanks, womble.

share|improve this answer
I'd negate the source address and switch to -j DROP; saves a rule, and makes the intent clearer, IMAO. – womble Jan 7 '10 at 2:16
Absolutely. My linear thinking comes out... – Evan Anderson Jan 7 '10 at 2:19
The one liner syntax above has been deprecated in favor of moving the negation (!) in front of the whole argument instead of just the argument value like this: iptables -A INPUT -p tcp --dport 25 ! -s x.x.x.x -j DROP – Caleb Jun 30 '10 at 13:35

Something like this is more future proof, in case you need to allow more addresses.

iptables -A INPUT -p tcp --dport 25 -s x.x.x.x -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

it is also easier to transition from that to a default DENY policy, which is always a good thing.

Additionally, most mail servers let you define the list of addresses allowed to relay, which can add another level of protection. You didn't say which mail server you are using, but they all should have this feature.

share|improve this answer
Thanks. Sendmail. But I'm also using this tidbit for a similar (non SMTP) application on another server. – jamieb Jan 7 '10 at 4:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.