iptables: Allow connections on a port to only “safe” hosts

Question

I have a centos machine and wish to only allow outbound connections to port 587 to certain remote machines, and drop packets trying to connect to all other hosts.

I only want to allow access on port 587 if they are going to access gmail's SMTP servers (all IPs behind smtp.gmail.com). Is there a way I can implement this?

Answer 1

You can use the -d switch to iptables rules which makes the rule work for just the address supplied and then block everything else e.g.

iptables -I OUTPUT -p tcp --dport 587 -j DROP
iptables -I OUTPUT -d smtp.gmail.com -p tcp -m tcp --dport 587 -j ACCEPT

should do what you want. This initially inserts a DROP all outgoing connections on port 587 rule into the beginning of the OUTPUT chain. It then inserts an allow rule for smtp.gmail.com port 587 into the beginning of the OUTPUT chain. This has the effect of allowing connections to smtp.gmail.com:587 and blocking everything else on port 587 e.g.

iptables -L OUTPUT -n
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            173.194.66.109      tcp dpt:587
ACCEPT     tcp  --  0.0.0.0/0            173.194.66.108      tcp dpt:587
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:587

Note that smtp.gmail.com resolves to two ip addresses which is why there are two ACCEPT rules above. The name is only resolved once when the rule is added to the kernel so if the addresses are changed then connections to gmail will be blocked too and you would need to reload the rules.

Answer 2

You need to allow gmail before you deny access. Otherwise you don't get to the allow rule.

Google may use any address in their ASN for Gmail servers, you you will want to allow all the blocks. You may want to look at using an ipset to handle the blocks involved. You may also find their SPF record provides a decent list of network blocks for your requirements. If you reject, rather than drop outgoing requests your users may not notice a few missing blocks.

A tool like Shorewall will allow you to implement your policies more easily. In your case I would have an outgoing REJECT policy and only allow desired traffic out. In that case you wouldn't need a specific rule to prevent access to the the submission port. Shorewall also enables easy configuration of logging for your firewall.

Answer 3

I'd suggest automating this whole thing so that you don't have to continue to worry about it.

The iptables -I OUTPUT -p tcp --dport 587 -j DROP should be included in your basic system configuration, which probably lives in /etc/sysconfig/iptables on your machine.

Drop this script into an editor and save it someplace, then mark it executable with chmod. As an example, I placed it in /opt/sysadminscripts/iptables.smtp.gmail.sh

#!/bin/bash

IPLIST=$(host smtp.gmail.com | grep 'has address' | awk '{print $4}')

for x in $IPLIST
do
        $(iptables -L -nv | grep "$x" >> /dev/null)
        if [[ "$?" -ne '0' ]]; then
                $(iptables -I OUTPUT  -p tcp -m tcp -d "$x" --dport 587 -j ACCEPT)
        fi
done

Then add an entry in your system crontab similar to this:

*/10 * * * * root /opt/sysadminscripts/iptables.smtp.gmail.sh

Make sure that the line is NOT the last line in your /etc/crontab. If the line doesn't have a terminating line feed, it won't run. (I recommend keeping a comment as the last line of /etc/crontab.)

Answer 4

You need to have rules like:

iptables -A FORWARD -p tcp -d smtp.gmail.com --dport 587 -j ACCEPT
iptables -A FORWARD -p tcp --dport 587 -j DROP

The problem is that you need to find the possible IPs for smtp.gmail.com. It is not recommended to use the name in iptables. This is because iptables will not recognize the IP-name mapping changes. You may need to continuously check for the IP change and update your rules accordingly.

You need to pick the right chain FORWARD in the above example depending on which traffic you want to control.