Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

first of all congratulations about this website, I just found it ...guess....googling, hehe.

Secondly, sorry for my English since I´m Spanish.

My question is about a Prerouting rule which doesn´t work in my iptable script.

The rest of rules (input, output, forward...) work fine but not this ones:

iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 25 -j DNAT --to

(eth2 is the interface attached to the internet )

I have to say I have my script begining with DROP, like this:

iptables -p INPUT DROP
iptables -p OUTPUT DROP
iptables -p FORWARD DROP

But I don´t have any sentence like: iptables -P PREROUTING ACCEPT | DROP

With iptables -L -n I don´t see any rule making possible the traffic to the port TCP 25 into my LAN, that makes me think something is wrong and in Wireshark I can see how the external MTA (gmail, et cetera) tries to connect with my Firewall but only gets a SYN Packet, three packets actually.

I´ve read I need a postrouting rule for this specific port (25) but I have this rule with postrouting, which seems to me enoguh, but not sure because I come from ISA Server and things work in a different way from a GUI:

iptables -t nat -A POSTROUTING -s -o eth2 -j MASQUERADE

This rule I´ve just writen is (I think) the rule about NAT, so that the Linux server can be a NAT Server.

share|improve this question

According to what you wrote, you should add a rule allowing traffic from the outside (internet) reach your mailserver; something like this:

iptables -A FORWARD -p tcp -d --dport 25

You can restrict this rule to some extent, so that you'll allow only SYN packet and then related packets, but this is the basis. Once this work, you can tweak it further.

Remember that when you use NAT rules, you should write your FILTER rules as if your NAT rules do not exist (i.e. you should write as if they are transparent to you).

Also, I would suggest taht you rather add a 'last' rule in the main chains (INPUT, OUTPUT and FORWARD) so that you can catch what is refused, rather than having it dropped/rejected silently. Soemthing like:

  iptables -A INPUT -j LOG --log-prefix "INPUT: "
  iptables -A INPUT -j DROP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.