Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Current setup

Centos which is a Web, Mail (Postfix,Dovecot), FTP Server and Gateway with public ip and private ip (for LAN Gateway).

We are planning to implement external firewall box and bring the server to LAN

Please guide on configuring IPTables... Unable to receive mail and outgoing mail stays in postfix queue and is sent after delaying...

The local ip of the server is 192.168.1.220

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# incoming HTTP
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

#outgoing HTTP
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

# FTP
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 192.168.1.220 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.220 --sport 21 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 192.168.1.220 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.220 --sport 1024:65535 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

#SMTP
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 192.168.1.220 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.220 --sport 25 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.220 --sport 1024:65535 -d 0/0 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 25 -d 192.168.1.220 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

#POP3
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 192.168.1.220 --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.220 --sport 110 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
share|improve this question
add comment

2 Answers

You can simplify these rules to this.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i eth0 -m multiport -p tcp --dport 80,443,21,25,110 -m state --state NEW -j ACCEPT

iptables -A OUTPUT -o eth0 -m multiport -p tcp --dport 80,443,21,25,110 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 53 -m state --state NEW -j ACCEPT

Also you need to load the ftp tracking module.

modprobe ip_nat_ftp

I have added a rule to allow DNS lookups, as mail cannot operate without DNS.

share|improve this answer
    
Thanks for the reply... My External firewall private ip is 192.168.1.5 just want to send the outgoing mail traffic from postfix (mail server) to 192.168.1.5 and the accept incoming mail traffic from internet through firewall to the internal mail server.... Currently i am not able to receive mail to the server... Kindly guide on the rules –  user137974 Sep 24 '12 at 5:02
    
Please explain properly as i cannot understand why your external firewall private IP address and the postfix address is the same, are they one and the same. Please update your question to give a correct description of what your issue it. –  topdog Sep 24 '12 at 6:11
    
Firewall Box ip 192.168.1.5 Internal Server ip 192.168.1.1 Now the filter rules are set The nat, mangle have default accept policy. I want to forward the outgoing mail traffic, web traffic to the firewall (192.168.1.5) Pls help –  user137974 Sep 26 '12 at 11:46
add comment

If I understood correctly you have a firewall and another internal server. In this case:

INPUT and OUTPUT chains are for traffic in and out the firewall. Your rules should be on FORWARD chain. Also you need rules for NAT. SNAT for letting internal server to access internet and DNAT for redirecting external traffic to internal server.

First check if you have forwarding enabled.

Set:

net.ipv4.ip_forward = 1

in /etc/sysctl.conf

Assuming that:

  • firewall ip is 192.168.1.5 with network interfaces: eth0 WAN, eth1 LAN

  • http/mail server ip is 192.168.1.1

Try:

###load ftp nat modules
/usr/sbin/modprobe ip_nat_ftp
/usr/sbin/modprobe ip_conntrack_ftp

### set chains policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

### for server to access internet
### SNAT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
### and allow full server access
iptables -A FORWARD -i eth1 -s 192.168.1.1 -j ACCEPT

### for incoming http connections
### DNAT
iptables -t bat -A PREROUTING -i eth0 -p tcp --dport 80 -j NAT --to-destination 192.168.1.1:80
### and allow forward
iptables -A FORWARD -i eth0 -p tcp --dport 80 -d 192.168.1.1 -j ACCEPT

To redirect other ports to server copy the last 2 lines (DNAT and forward) and change port to 110, 443, etc.

Don't forget to add rules for input or output, at least

IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

to be able to access firewall by ssh

share|improve this answer
    
Yes that is right. I want to forward the outgoing mail traffic, web traffic from internal mail server (192.168.1.1) to the firewall (192.168.1.5). Pls help with nat and mangle rules. –  user137974 Sep 26 '12 at 11:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.