Server Firewall preventing sending of email [closed]

Question

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless.

I am able to send email if I open INPUT ports 32768-65535, but not if these ports are closed. Why would this be?

I have the following rules in my firewall (N.B. I have excluded rules that are limited to my IP, e.g. ssh, etc):

# sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
VZ_INPUT   all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
VZ_FORWARD  all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
VZ_OUTPUT  all  --  anywhere             anywhere

Chain VZ_FORWARD (1 references)
target     prot opt source               destination

Chain VZ_INPUT (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:32768:65535
ACCEPT     udp  --  anywhere             anywhere            udp dpts:32768:65535
ACCEPT     tcp  --  localhost.localdomain  localhost.localdomain
ACCEPT     udp  --  localhost.localdomain  localhost.localdomain

Chain VZ_OUTPUT (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere

The VPS is running Plesk 10.4.4
Edit: The mail server is qmail
Edit: The rules are created by the Firewall module of "Virtuozzo Power Panel"
(please ask if you require further technical information to help me)

Answer 1

I think you're droping incomming answers. Try adding it with

-m state --state RELATED,ESTABLISHED -j ACCEPT

to VZ_INPUT

Answer 2

I think you need to read up on ephemeral ports so you can understand a bit more about how your machine makes outbound connections.

When your server makes an outbound SMTP connection (destination port 25, allowed by your very permissive OUTPUT rule) the responses will come back to the ephemeral port that your server sourced the connection from. By default, the Linux ephemeral port range is 32768 to 61000. When you're disallowing INPUT traffic on ports 32768 to 65535 you're blocking the responses from the remote SMTP server.

These firewall rules seem rather unconventional to me. It's pretty atypical, at least in my experience, to see firewall rules that don't take advantage of ip_conntrack and stateful filtering. Some searching for the names "VZ_FORWARD", "VZ_INPUT", etc, shows me that these are a pretty typical ruleset that some virtual server management package is creating. I'd use stateful filtering, personally, but there may be a performance argument against doing so for the VPS provider.

Edit:

If you're interested in learning more about netfilter, the official documentation isn't a bad place to start, though some of that doucmentation is a little dated. You don't mention what distribution you're using, but you can find some distribution-specific documentation out there. You mention in another comment that you want to limit your modifications to the GUI manager you're using. That may limit your ability to make significant changes to the configuration. Even if you're not going to hand-modify the configuration you'll probably gain useful knowledge by reading up on netfilter a bit.

re: your OUTPUT chain - A security-minded admin would want to lock down the OUTPUT traffic so that, should malicious attackers gain control of the server computer in a non-superuser capacity, they are limited in what types of traffic can egress from the machine to the Internet. Some worms, for example, expect to be able to make HTTP (or FTP, or TFTP) requests back to the Internet to download their "second stage" components. When you remove the ability for the server to make arbitrary requests to the Internet you can limit what a malicious attacker can cause your machine to do. (Obviously, if they get super-user level access then "game over"-- they can just modify the firewall rules.)

Answer 3

Looking at VZ_INPUT:

ACCEPT tcp -- anywhere anywhere tcp dpt:smtp

This allows incoming connections to your SMTP server.

Your output rules allow anything.

But when you are sending emails your machine acts as the CLIENT not the server.

So when you try to send email, the SYN packet goes out from, say, port 32768, to port 25, then ack returns from port 25 to port 32768 - which only matches the silly rule added at the end.

hence adding a reverse rule to VZ_INPUT will allow the traffic:

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp

Or, as Mose suggests allow related traffic on VZ_INPUT. The latter is actually a better solution as the stateless version above will not block access to your servers ports by an attacker who forces his client port to 25.

You really should implement proper egress filtering on your server - hence you should (as Dennis says) allow established,related on vz_output, along with valid client protocols such as DNS, SMTP and NTP along with a default DENY policy.

BTW: how do you get a shell on the system when it doesn't allow ssh/rsh/telnet ?