Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can't seem to open port 25 on my CentOS 6.3 dedicated server.

telnet localhost 25

works fine, however when trying remotely

telnet mydomain.com 25
Connecting To mydomain.com...Could not open connection to the host, on port 25: Connect failed

This is how my /etc/sysconfig/iptables look like:

# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*raw
:PREROUTING ACCEPT [1239:156878]
:OUTPUT ACCEPT [1017:172599]
COMMIT
# Completed on Tue Dec 11 20:24:48 2012
# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*nat
:PREROUTING ACCEPT [139:41210]
:INPUT ACCEPT [12:976]
:OUTPUT ACCEPT [91:14636]
:POSTROUTING ACCEPT [91:14636]
COMMIT
# Completed on Tue Dec 11 20:24:48 2012
# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*mangle
:PREROUTING ACCEPT [1239:156878]
:INPUT ACCEPT [1239:156878]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1017:172599]
:POSTROUTING ACCEPT [1017:172599]
COMMIT
# Completed on Tue Dec 11 20:24:48 2012
# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [107:13896]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Dec 11 20:24:48 2012

I thought that this means my port 25 is open, but it's still not working. Ideas anyone? By the way, /etc/postfix/main.cf says

inet_interfaces = all

UPDATE:

I have switched the two lines in iptables as suggested, so now:

netstat -tnlp | grep 25

tcp        0      0 0.0.0.0:110                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:143                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      2521/sshd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      6754/master
tcp        0      0 123.123.123.123:25          0.0.0.0:*                   LISTEN      6754/master
tcp        0      0 0.0.0.0:4190                0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:993                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:995                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 :::110                      :::*                        LISTEN      2581/dovecot
tcp        0      0 :::143                      :::*                        LISTEN      2581/dovecot
tcp        0      0 :::22                       :::*                        LISTEN      2521/sshd
tcp        0      0 :::4190                     :::*                        LISTEN      2581/dovecot
tcp        0      0 :::993                      :::*                        LISTEN      2581/dovecot
tcp        0      0 :::995                      :::*                        LISTEN      2581/dovecot

I take it this means port 25 is open and postfix is listening on it?

My dedicated server provider is OVH and they claim they don't block port 25: http://help.ovh.com/FireWall

This looks like a dead end...

UPDATE 2: Solved, my ISP wasn't blocking port 25, but my VPN provider was. Curse them. Thanks everyone for help.

share|improve this question
    
It's better to look at the actual running configuration rather than the stored-on-disk configuration. They can differ. In your case: iptables -L -nv, postconf -n and netstat -tlnp. My guess is that it's none of these and your hosting provider is blocking port 25 inbound with their own firewall. –  Ladadadada Dec 11 '12 at 19:40
    
You are blocking port 25 at the -j REJECT [...] line. Re-add your accept rules with 'iptables -I INPUT 1 -p tcp --dport 25 -j ACCEPT' –  CloudWeavers Dec 11 '12 at 19:47
    
@CloudWeavers I did so the first time, didn't help –  Caballero Dec 11 '12 at 19:48
1  
Your server provider might not block port 25, but most home ISPs block customers from connecting to port 25. So if you are testing from home that is probably the issue. –  Anton Cohen Dec 11 '12 at 19:58
    
Did you reload your iptables service iptables restart ? –  Iain Dec 11 '12 at 19:59

1 Answer 1

up vote 7 down vote accepted

The accept line for your port 25

-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT

comes after the blanket reject

-A INPUT -j REJECT --reject-with icmp-host-prohibited

Switch them round and reload. Iptables works on first match wins so the ACCEPT will never be actioned. The reason you can connect to localhost is that there is a blanket accept

-A INPUT -i lo -j ACCEPT 

before the reject.

If that doesn't work, then ckeck postfix is listening on the relevant IP address, check the output of

netstat -tnlp | grep 25 

and take approprite action. If it's not that then it's most likely that someone else is blocking port 25 upstream of you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.