Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to setup IpTable Rules for a server with nginx, ssh and sendmail. Now, the problem is, with my rules I can not send emails to other hosts anymore. Emails to localhost do work, but sending to different servers does not, when the firewall is up.

I tried opening both Incoming and Outgoing Port 25 and DNS lookup ports, but nothing worked. Any ideas?


Here are my rules:

#! /bin/sh
# firewall iptable rules


# first, deny all
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# open loopback device completely
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# open ssh ports
iptables -A INPUT -p tcp -i $interface --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -o $interface --sport 22  -m state --state ESTABLISHED,RELATED -j ACCEPT

# open browser ports
iptables -A INPUT -p tcp -i $interface --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -o $interface --sport 80  -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this question
show us your rules? – quanta Aug 30 '12 at 11:01
Please, post the output iptables-save. – Khaled Aug 30 '12 at 11:08
as of now, these are my rules – s1ck Aug 30 '12 at 11:12
There are no entries for port 25 or 53 in those rules. – Jenny D Aug 30 '12 at 11:36
@s1ck: I edited your question to include the rules. Your question will become useless in case the link is broken in the future. – Khaled Aug 30 '12 at 12:38
up vote 3 down vote accepted

If you want to allow your Linux box to send emails via port 25, you should allow it by adding a rule like:

$ iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

Similarly for DNS traffic:

$ iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

If there is no such explicit rules, the traffic will be denied by default as the default policy is set to DROP.


Don't forget to allow the related/established connections using:

$ iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$ iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
it still doesnt work. if I do a "echo 'test'|mailx -s "test" -F" it just stays open until I cancel with ^C. without the rules, it sends immediately – s1ck Aug 30 '12 at 12:49
@s1ck: I updated my answer. – Khaled Aug 30 '12 at 13:10
thank you very much! – s1ck Aug 30 '12 at 14:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.