Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the sendmail daemon disabled (by setting DAEMON=no in /etc/sysconfig/sendmail). It is not listening on port 25.

Instead I'm using a custom SMTP server.

  • Before: It listened on port 25. It accepted mail from outside and local mail, both (as I want). But bad to run as root.
  • After: I just changed it to listen to port 25252, and used iptables to redirect traffic from 25 to 25252.

This works fine for other machines connecting to port 25; it's redirected to 25252.

However mail sent locally (e.g. cron, monit) is still trying to connect on port 25 and there is nothing there anymore.

To get local mail routed to my replacement SMTP server, it seems like the two choices are:

  1. Change local mail sends to connect to port 25252.
  2. Make iptables work on local traffic and redirect that from 25 to 25252, too.

I'd prefer 2 (if possible) because it's extending the same approach I'm already using (and sendmail mc files make my head spin). But either way, 1 or 2, I'd be grateful to anyone who can help me learn how to do this. Thank you.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Can you please try with:

iptables -t nat -A OUTPUT -p tcp -o lo --dport 25 -j DNAT --to-destination :25252

Or with:

iptables -t nat -A OUTPUT -p tcp -o lo --dport 25 -j DNAT --to-destination IP:25252

where IP is the IP which sendmail is using for listen. You can find it with:

sudo netstat -tlnp|grep sendmail
share|improve this answer
Thank you. I had tried: $ sudo iptables -t nat -A PREROUTING -p tcp --dport 25 -j REDIRECT --to-port 25252 Are you suggesting I do what you said in addition to that? Also, when you mention "listen": To clarify, I'm trying to get the local mail agent (e.g. what `mail' at the command line would do) to send to port 25252. I don't want the standard sendmail to listen to anything at all. Thanks again. –  Greg Hendershott May 3 '11 at 21:12
OK the following worked, between your answer and looking at serverfault.com/questions/247485/… . thank you. $ sudo iptables -t nat -A OUTPUT -p tcp --dport 25 -j REDIRECT --to-port 25252 –  Greg Hendershott May 3 '11 at 21:29
Oh, sorry. It should be -A or -I, depends on your configuration, and not -D. It was a typo. I've edited my answer. –  Mircea Vutcovici May 4 '11 at 15:14
Also it seemed that it had to be --to-port not --to-destination ? :) But again, thank you for getting me on the right track to look at the OUTPUT chain and from there it was short strokes to something that worked for me. –  Greg Hendershott May 4 '11 at 15:45

Question: Can't you make the custom SMTP server bind in port 25/tcp as root and then drop its privileges?

share|improve this answer
That's a good idea (I've read that's how e.g. Apache does it for port 80). But wouldn't it still need to be started by root or with sudo? That complicates having things like monit be able to start or restart it automatically, if you don't otherwise need them running at root either. Also I'm doing this in a cross-platform language (Racket) and prefer to avoid this kind of platform-specific privilege-dropping. But again, good answer and if I already had the rep here I'd upvote it as well as the answer I already accepted. –  Greg Hendershott May 4 '11 at 14:25
It can be started by root, or be a setuid script. Or you can divide your program in two parts, a very simple one that binds to port 25/tcp and then forks (or spawns depending the operating system) the actual server. That way, the simple first part is the one that will need versions for multiple architectures. You can ask StackOverflow on how to do that with Scheme. –  adamo May 4 '11 at 19:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.