Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have sendmail installed on Ubuntu 10.04 solely for the use of the php mail() function. This works fine unless iptables is running (I've been using sendmail myemailaddress@domain.com to test this).

I think that I have allowed SMTP and DNS (the script I am using to test iptables rules is below, in my version are the actual IPs of my hosts nameservers), but to no avail!

iptables --flush

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Postgres
iptables -A INPUT -p tcp --dport 5432 -j ACCEPT

# Webmin
iptables -A INPUT -p tcp --dport 10000 -j ACCEPT

# Ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

# sendmail
iptables -A INPUT -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

# DNS
iptables -A INPUT -p udp --sport 53 -s <nameserver1> -j ACCEPT
iptables -A INPUT -p udp --sport 53 -s <nameserver2> -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -s <nameserver1> -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -s <nameserver2> -j ACCEPT

iptables -A OUTPUT -p udp --dport 53 -d <nameserver1> -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -d <nameserver2> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -d <nameserver1> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -d <nameserver2> -j ACCEPT


iptables -A INPUT -j DROP

# Add loopback
iptables -I INPUT 1 -i lo -j ACCEPT
share|improve this question

2 Answers 2

up vote 8 down vote accepted

Currently you have:

iptables -A INPUT -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

Which allows:

  • packets to your sendmail in,
  • packets from your port 25 out, but only for already established connections (so only connections from the outside).

For outgoing E-mails, you need your sendmail to be able to connect to the outside world.

So you'll need something like this as well:

iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

Please make sure you don't become an open relay.

share|improve this answer
    
That did it, thanks! Do you have any tips on not becoming an open relay? –  tom Jul 4 '12 at 13:13
2  
Glad I could help! postfix should have fairly sensible default settings, so the idea is to not open too much. But if your host only needs to be able to send E-mails out, not get E-mails in, you can remove this rule altogether to secure at the firewall level: iptables -A INPUT -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT. –  Pierre Carrier Jul 4 '12 at 13:32

I am assuming you will be connecting to a relay (smarthost) to send mail and don't need any incoming mail. If not, will have more work to do. Automated systems tend not to have well configured email services which can result in their mail being dropped or sent to the spam bucket.

You may want to use conntrack to handle established connections. This simplifies the rest of your rules as you only need to worry about new connections in the rest of the rules.

iptable -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptable -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Your rules before your ping entries look good.

Your rules need to cover outgoing traffic

iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

Your ICMP rules seem incomplete

iptables -A INPUT -p icmp --icmp-type 3/4 -j ACCEPT 
iptables -A INPUT -p icmp --icmp-type 11 -j ACCEPT 
iptables -A OUTPUT -p icmp --icmp-type 3/4 -j ACCEPT 
iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT 
iptables -A OUTPUT -p icmp --icmp-type 11 -j ACCEPT 
share|improve this answer
    
Thanks Bill. What are the implications for not including these additional ICMP rules? –  tom Jul 4 '12 at 13:23
1  
EDIT: ICMP types 3 and 4 are used to indicate unreachable hosts (and why they are unreachable), and to control network congestion. In particular type 3 (unreachable)/code 4(fragmentation required) is used in MTU discovery. –  BillThor Jul 6 '12 at 0:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.