up vote 0 down vote favorite
share [g+] share [fb]

I have OpenVPN configured on a Centos server and client can connect via OpenVPN client from their Windows box on port 1194. Clients get the gateway 10.0.8.1.

The problem is clients' boxes have viruses on their system and they are sending spam via my OpenVPN server; I just want to block port 25 for my clients.

I added the following rule in my iptables, which allows all traffic and drops port 25.

iptables -t nat -A PREROUTING  -p tcp --dport 25 -j DROP
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

eth0 is the interface of the OpenVPN server.

But still it is sending spam.

Can anybody suggest how can I block the emails from my OpenVPN client machines?

link|improve this question
feedback

migrated from stackoverflow.com Oct 2 '11 at 19:59

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 0 down vote

Try to filter using the FORWARD table:

iptables -A FORWARD -s 10.8.0.0/24 -p tcp --dport 25 -j DROP

Also, if you are running SMTP on your server, you may need to block access to it:

iptables -A INPUT -s 10.8.0.0/24 -p tcp --dport 25 -j DROP

Assuming OpenVPN is using the default 10.8.0.0/24 IP address range, of course.

link|improve this answer
feedback
up vote 0 down vote

You need to block the source port not the destination port lie so. $VPN is the interface that the VPN server is routing its traffic on.

iptables -A FORWARD -p tcp -i $VPN  --sport 25  -j DROP
link|improve this answer
I don't know any mail systems, viruses or otherwise, that use source port 25 for sending email. Is that something unique to the VPN setup here, or is that actually intended to stop packets originating from source port 25 on the client machines? – sarnold Oct 2 '11 at 2:12
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.