Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

My server is running Ubuntu 10.04.4 LTS and I want to reject traffic to port 25. The goal is this:

$ telnet {ip} 25
Trying {ip}...
telnet: connect to address {ip}: Connection refused
telnet: Unable to connect to remote host

I've tried using iptables directly, but that failed. Instead, I'm now trying uwf:

$ ufw reject 25

However, it doesn't work as expected:

$ telnet {ip} 25
Trying {ip}...
# Waiting for a minute…
telnet: connect to address {ip}: Connection refused
telnet: Unable to connect to remote host

If I try the same with any other port (say, 23), it works without the waiting time. This is strange, because nothing is going on on port 25 according to netstat.

How can I reject traffic to port 25 directly, without this delay?
Note that the same technique on another server worked.



Update: here's the relevant part of iptables:

Chain ufw-user-input (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:www 
REJECT     tcp  --  anywhere             anywhere            tcp dpt:smtp reject-with tcp-reset 
REJECT     udp  --  anywhere             anywhere            udp dpt:25 reject-with icmp-port-unreachable 
REJECT     tcp  --  anywhere             anywhere            tcp dpt:telnet reject-with tcp-reset 
REJECT     udp  --  anywhere             anywhere            udp dpt:23 reject-with icmp-port-unreachable

Update: answers to comments

  • ufw deny 25 does not work either.
  • I'm connecting from a remote location.
share|improve this question
Can you use deny instead of reject and check if it helps? – Hex Jan 16 at 10:53
Are you trying to connect to the server from within the same LAN or from a remote location? – Khaled Jan 16 at 11:04
I've added clarifications to the question. – Ruben Verborgh Jan 16 at 14:28

1 Answer

up vote 0 down vote

tcpdump time:

tcpdump -s0 -w /tmp/tracefile.pcap tcp port 25

CTRL-C when done testing, then load the file up in Wireshark.

share|improve this answer
Done that, but strangely enough I get "0 packets received by filter", "0 packets dropped by kernel". Could that mean some other firewall is intercepting traffic to port 25? (Doing the same with the blocked port 23 results in 2 received packets.) – Ruben Verborgh Jan 16 at 18:30
The traffic never reaches your server. – adaptr Jan 17 at 8:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.