Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have OpenVPN configured on a Centos server and client can connect via OpenVPN client from their Windows box on port 1194. Clients get the gateway 10.0.8.1.

The problem is clients' boxes have viruses on their system and they are sending spam via my OpenVPN server; I just want to block port 25 for my clients.

I added the following rule in my iptables, which allows all traffic and drops port 25.

iptables -t nat -A PREROUTING  -p tcp --dport 25 -j DROP
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

eth0 is the interface of the OpenVPN server.

But still it is sending spam.

Can anybody suggest how can I block the emails from my OpenVPN client machines?

share|improve this question

migrated from stackoverflow.com Oct 2 '11 at 19:59

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers 2

You need to block the source port not the destination port lie so. $VPN is the interface that the VPN server is routing its traffic on.

iptables -A FORWARD -p tcp -i $VPN  --sport 25  -j DROP
share|improve this answer
    
I don't know any mail systems, viruses or otherwise, that use source port 25 for sending email. Is that something unique to the VPN setup here, or is that actually intended to stop packets originating from source port 25 on the client machines? –  sarnold Oct 2 '11 at 2:12
add comment

Try to filter using the FORWARD table:

iptables -A FORWARD -s 10.8.0.0/24 -p tcp --dport 25 -j DROP

Also, if you are running SMTP on your server, you may need to block access to it:

iptables -A INPUT -s 10.8.0.0/24 -p tcp --dport 25 -j DROP

Assuming OpenVPN is using the default 10.8.0.0/24 IP address range, of course.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.