Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web site which needs to send email to confirm orders and alert subscribed users of certain events. I do not need to send email through the server for any other reason, so I would like to prevent anyone outside of localhost from even connecting to port 25 for SMTP. I've tried to do this like so:

sudo iptables -A INPUT -p tcp -s --dport 25 -j DROP

but I can still telnet to port 25 and type SMTP commands from another computer. What am I doing wrong? Also, is there a better way to achieve what I want? To clarify: what I want is a machine that can send emails (via SMTP), but only ones that originate from scripts running on the machine. And any configuration must "live" through re-boots.

I'm using Postfix on Ubuntu (Hardy).

share|improve this question
up vote 9 down vote accepted

I think that a better solution, if you don't want to be able to receive emails from outside, is to tell postfix that exactly, in the file replacing :

smtp      inet  n       -       n       -       -       smtpd

which is usually the first non comment line, but your mileage may vary depending on wether the postfix you have is modified by your vendor, with :      inet  n       -       n       -       -       smtpd
share|improve this answer
+1 Fixing the problem not the symptoms. Much better than using iptables to block the ports. – Grhm Feb 16 '10 at 8:28

I believe you don't want the -s clause. You're only denying access from the address.

You probably need something like:

sudo iptables -A INPUT -p tcp -s --dport 25 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 25 -j DROP

This will accept any incoming connection from the localhost (i.e. from the loopback range - and drop all others.

share|improve this answer
This works perfectly, thanks. But is there a way to get it to persist through server reboots? A config file to edit somewhere? (sudo find /etc -name iptables gives me nothing.) – Alex Reisner Feb 15 '10 at 17:26
You want to install a /etc/init.d/iptables script, and set up a /var/lib/iptables/active file with your rules. See – PP. Feb 15 '10 at 17:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.