Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have these settings in /etc/sysconfig/iptables

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 8000 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

I think i should have 25 port open , and i rebooted my machine , but i got error "Connecting To mydomain.com...Could not open connection to the host, on port 25: Connect failed" "telnet: Unable to connect to remote host: Connection refused" by running "telnet mail.mydomain.com 25"

i tested locally by running 'telnet localhost 25', it was running fine . I got "220 mail.mydomain.com ESMTP Postfix"

Something else I need to configure to open port 25?

This is Centos 5.4

Thanks

share|improve this question
    
Is there something bound to that port? Where are you connecting from/to? Can you connect to the other ports? –  Ignacio Vazquez-Abrams Aug 27 '10 at 0:46
    
i think postfix is using this post? I like to telnet to test postfix –  Wei Aug 27 '10 at 0:56
    
I can connect to ssh post 22 no problem and httpd port 80 –  Wei Aug 27 '10 at 0:57
    
Don't think. Use netstat to verify. –  Ignacio Vazquez-Abrams Aug 27 '10 at 1:03
    
when i ran netstat -an I got this "tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN " does it look right? –  Wei Aug 27 '10 at 1:11
show 1 more comment

2 Answers

up vote 1 down vote accepted

Have you checked to see if you have a firewall sitting in front of this host preventing incoming port 25? The rules you have listed should definitely let you in. In fact, you have port 25 allowed twice.

On a side note, you should keep your rules consistent with Red Hat/CentOS's conventions. These rules:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT

Should look like this, placed after the ESTABLISHED,RELATED line like so:

-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 23 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT

Also, make sure you run /etc/init.d/iptables restart after making changes to this file. To confirm if they've been applied, run:

# iptables -L -n | grep 25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25

Good Luck.

share|improve this answer
    
thanks , i do see "ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25 " –  Wei Aug 27 '10 at 3:30
    
In this case, there's nothing on your local server that should be preventing you from taking incoming connections on port 25. It's likely a firewall sitting in front of your machine. You may want to contact your service provider to confirm. –  vmfarms Aug 27 '10 at 3:43
    
thanks! problem solved , it was because the setting in my postfix main.cf. I changed "inet_interfaces = localhost" to "inet_interfaces = $myhostname " –  Wei Aug 27 '10 at 4:14
add comment

As Ignacio mentioned, you might want to be sure that Postfix is actually listening on that port, and accepting connections. It might simply be that it's configured to send mail via port 25, and not accept it. Some commands for that: netstat -an to see what's listening. Something better be listed on port 25 for telnet to connect. Look into tcpdump to actually capture packets on the server, and see if your telnet is getting through or not. Likewise, you might want to turn on iptables logging to make sure that really is what's killing your packets.


--Christopher Karel

share|improve this answer
    
when i ran netstat -an I got this "tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN " –  Wei Aug 27 '10 at 1:10
    
by the way i tested locally by running 'telnet localhost 25', it was running fine . I got "220 mail.mydomain.com ESMTP Postfix" –  Wei Aug 27 '10 at 1:36
    
thanks! problem solved , it was because the setting in my postfix main.cf. I changed "inet_interfaces = localhost" to "inet_interfaces = $myhostname " –  Wei Aug 27 '10 at 4:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.