Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, so Many ISPs are now blocking port 25 on outgoing connections, so I set up an smtp server on port 1025. Now this works great and configured clients send mail properly. But for most of the code already on the server, the smtp server should be on 25, now rather than reconfigure all the code to use the new port I was thinking of establishing a tunnel or something to force all from localhost to 25 to go to localhost on 1025.

I tried this and it did not work

iptables -t nat -A PREROUTING -p tcp -i lo --dport 25 -j DNAT --to

what can I do to accomplish this?

thank you

share|improve this question
up vote 3 down vote accepted

To forwarding from localhost use xinetd:

service smtp
        socket_type             = stream
        wait                    = no
        user                    = root
        redirect                = 1025
        bind                    =
share|improve this answer
this was magicall, how did I not know this existed! thanks – cromestant Feb 4 '11 at 10:18

You are doing it wrong, the concept is almost the contrary, try this instead:

iptables -t nat -I PREROUTING -p tcp --dport 1025 -j REDIRECT --to-ports 25
share|improve this answer
Tmow, I think Alex wasn't wrong. The OP said he's already running an MTA on 1025 and wants to have connections to 25 redirected to it. Had he wanted instead to keep his MTA on 25 and just have 1025 redirected instead, your recipe would be good - and less work for him. But since he's already moved his MTA, I think Alex has the right approach. – MadHatter Feb 4 '11 at 10:00
Yes the MTA is on 1025 already. I want to have access also on 25 from the localhost. Unfortunately it does not work yet. – cromestant Feb 4 '11 at 10:11
@MadHatter thx, didn't get it – tmow Feb 4 '11 at 10:35
Tmow, no worries! – MadHatter Feb 4 '11 at 10:37

You should use REDIRECT not DNAT for locally forwarded ports. Something like:

iptables -t nat -A PREROUTING -i lo -p tcp --dport 25 -j REDIRECT --to-ports 1025

share|improve this answer
don't work – alvosu Feb 4 '11 at 10:11
thanks alex, as it is its not working But It might be conflict with other firewall rules. I'll clean them up and try again. – cromestant Feb 4 '11 at 10:12
iptables -t nat -I OUTPUT 1 -o lo -d -p tcp --dport 25 -j REDIRECT --to-ports 1025
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.