Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless.

I am able to send email if I open INPUT ports 32768-65535, but not if these ports are closed. Why would this be?

I have the following rules in my firewall (N.B. I have excluded rules that are limited to my IP, e.g. ssh, etc):

# sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
VZ_INPUT   all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
VZ_FORWARD  all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
VZ_OUTPUT  all  --  anywhere             anywhere

Chain VZ_FORWARD (1 references)
target     prot opt source               destination

Chain VZ_INPUT (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:32768:65535
ACCEPT     udp  --  anywhere             anywhere            udp dpts:32768:65535
ACCEPT     tcp  --  localhost.localdomain  localhost.localdomain
ACCEPT     udp  --  localhost.localdomain  localhost.localdomain

Chain VZ_OUTPUT (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere

The VPS is running Plesk 10.4.4
Edit: The mail server is qmail
Edit: The rules are created by the Firewall module of "Virtuozzo Power Panel"
(please ask if you require further technical information to help me)

share|improve this question
1  
32768-65535 that is a massive range of ports. You haven't said what mail server you are using. I guess postfix? Have a look at the postfix/mail configuration and paste it here. Look at what ports are listed. Also use netstat --listening to see what ports your server is listening on. –  Sc0rian Nov 14 '12 at 11:40
    
Looks very much like it indeed –  Dennis Kaarsemaker Nov 14 '12 at 13:59
    
@Sc0rian: The problem isn't his server listening-- it's the responses coming back to the ephemeral port his server is SOURCING the outbound connection from. –  Evan Anderson Nov 14 '12 at 14:10
    
This question is worth linking to, though I'm wary of closing as an exact duplicate: serverfault.com/questions/339419/… Does anybody know what VPS management package is creating these VZ_xxx rules, anyway? I'm guessing they're doing stateless filtering for "performance" reasons. I see a lot of instances of them when I search for those chain names but nothing telling me what package is creating them. –  Evan Anderson Nov 14 '12 at 14:11
    
As stated in the edits to the original question: (@Sc0rian) the VPS is running qmail and (@Evan) the rules are created by the Firewall module of "Virtuozzo Power Panel". –  Jo Fitzgerald Nov 14 '12 at 15:42
add comment

3 Answers

I think you're droping incomming answers. Try adding it with

-m state --state RELATED,ESTABLISHED -j ACCEPT

to VZ_INPUT

share|improve this answer
1  
...and VZ_OUTPUT too if you're ever going to tighten that up. –  Dennis Kaarsemaker Nov 14 '12 at 11:55
    
I'm afraid I'm updating the firewall through a limted GUI module (similar to this) so I don't know how to add that. I would prefer to limit things to this module if possible. –  Jo Fitzgerald Nov 14 '12 at 15:12
    
@JoFitzgerald If that GUI doesn't add this rule automatically, it's completely broken. Contact your vendor for assistance. –  Michael Hampton Nov 14 '12 at 18:20
add comment

I think you need to read up on ephemeral ports so you can understand a bit more about how your machine makes outbound connections.

When your server makes an outbound SMTP connection (destination port 25, allowed by your very permissive OUTPUT rule) the responses will come back to the ephemeral port that your server sourced the connection from. By default, the Linux ephemeral port range is 32768 to 61000. When you're disallowing INPUT traffic on ports 32768 to 65535 you're blocking the responses from the remote SMTP server.

These firewall rules seem rather unconventional to me. It's pretty atypical, at least in my experience, to see firewall rules that don't take advantage of ip_conntrack and stateful filtering. Some searching for the names "VZ_FORWARD", "VZ_INPUT", etc, shows me that these are a pretty typical ruleset that some virtual server management package is creating. I'd use stateful filtering, personally, but there may be a performance argument against doing so for the VPS provider.

Edit:

If you're interested in learning more about netfilter, the official documentation isn't a bad place to start, though some of that doucmentation is a little dated. You don't mention what distribution you're using, but you can find some distribution-specific documentation out there. You mention in another comment that you want to limit your modifications to the GUI manager you're using. That may limit your ability to make significant changes to the configuration. Even if you're not going to hand-modify the configuration you'll probably gain useful knowledge by reading up on netfilter a bit.

re: your OUTPUT chain - A security-minded admin would want to lock down the OUTPUT traffic so that, should malicious attackers gain control of the server computer in a non-superuser capacity, they are limited in what types of traffic can egress from the machine to the Internet. Some worms, for example, expect to be able to make HTTP (or FTP, or TFTP) requests back to the Internet to download their "second stage" components. When you remove the ability for the server to make arbitrary requests to the Internet you can limit what a malicious attacker can cause your machine to do. (Obviously, if they get super-user level access then "game over"-- they can just modify the firewall rules.)

share|improve this answer
    
The iptables rules are created by the Firewall module of Virtuozzo Power Panel. My intention was to only allow INPUT access to required ports, but I had no guidance for OUPUT ports. @Evan, could you point me towards more conventional rules, please? –  Jo Fitzgerald Nov 14 '12 at 15:23
    
@JoFitzgerald - I dropped on an edit. –  Evan Anderson Nov 14 '12 at 15:41
add comment

Looking at VZ_INPUT:

ACCEPT tcp -- anywhere anywhere tcp dpt:smtp

This allows incoming connections to your SMTP server.

Your output rules allow anything.

But when you are sending emails your machine acts as the CLIENT not the server.

So when you try to send email, the SYN packet goes out from, say, port 32768, to port 25, then ack returns from port 25 to port 32768 - which only matches the silly rule added at the end.

hence adding a reverse rule to VZ_INPUT will allow the traffic:

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:smtp

Or, as Mose suggests allow related traffic on VZ_INPUT. The latter is actually a better solution as the stateless version above will not block access to your servers ports by an attacker who forces his client port to 25.

You really should implement proper egress filtering on your server - hence you should (as Dennis says) allow established,related on vz_output, along with valid client protocols such as DNS, SMTP and NTP along with a default DENY policy.

BTW: how do you get a shell on the system when it doesn't allow ssh/rsh/telnet ?

share|improve this answer
    
Many VPS providerss offer a vnc-ish interface to the console/desktop, maybe that's how he logs in? –  Dennis Kaarsemaker Nov 14 '12 at 13:58
    
Sorry, I should have mentioned that I have removed a few lines from the iptables output regarding ports limited to my IP (e.g. ssh) - I have now edited the question. I get the feeling that my output rules are 'non-standard', let's say :) Can you suggest what they should be? Should my output rules match my input rules? As you can see I'm pretty new to all this. –  Jo Fitzgerald Nov 14 '12 at 15:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.