Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to setup IpTable Rules for a server with nginx, ssh and sendmail. Now, the problem is, with my rules I can not send emails to other hosts anymore. Emails to localhost do work, but sending to different servers does not, when the firewall is up.

I tried opening both Incoming and Outgoing Port 25 and DNS lookup ports, but nothing worked. Any ideas?

Update:

Here are my rules:

#! /bin/sh
# firewall iptable rules

interface="eth0"

# first, deny all
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# open loopback device completely
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# open ssh ports
iptables -A INPUT -p tcp -i $interface --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -o $interface --sport 22  -m state --state ESTABLISHED,RELATED -j ACCEPT

# open browser ports
iptables -A INPUT -p tcp -i $interface --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -o $interface --sport 80  -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this question
2  
show us your rules? –  quanta Aug 30 '12 at 11:01
    
Please, post the output iptables-save. –  Khaled Aug 30 '12 at 11:08
    
as of now, these are my rules pastebin.com/PitS3E7C –  s1ck Aug 30 '12 at 11:12
    
There are no entries for port 25 or 53 in those rules. –  Jenny D Aug 30 '12 at 11:36
    
@s1ck: I edited your question to include the rules. Your question will become useless in case the link is broken in the future. –  Khaled Aug 30 '12 at 12:38
show 1 more comment

1 Answer

up vote 3 down vote accepted

If you want to allow your Linux box to send emails via port 25, you should allow it by adding a rule like:

$ iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

Similarly for DNS traffic:

$ iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

If there is no such explicit rules, the traffic will be denied by default as the default policy is set to DROP.

Update:

Don't forget to allow the related/established connections using:

$ iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$ iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
it still doesnt work. if I do a "echo 'test'|mailx -s "test" -F some@otherhost.com" it just stays open until I cancel with ^C. without the rules, it sends immediately –  s1ck Aug 30 '12 at 12:49
    
@s1ck: I updated my answer. –  Khaled Aug 30 '12 at 13:10
    
thank you very much! –  s1ck Aug 30 '12 at 14:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.