Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have had a look around and tried a number of things.

If I want a (centos) server to only be able to send emails (notifications to me) but have no other internet access in or out then what are the iptables.

I have tried this but does not work, only sends email when iptables is stopped.

   iptables -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
   iptables -A INPUT -p udp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
   iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
   iptables -A OUTPUT -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
   iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
   iptables -A INPUT -p tcp --dport 25 -m state --state ESTABLISHED -j ACCEPT
   iptables -A INPUT -p tcp -m tcp -j REJECT

Any help/knowledge?

Sendmail log shows: stat=Deferred: Connection refused by [127.0.0.1] when iptables active

Update: The following rules appear to work:

   iptables -A INPUT  -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
   iptables -A OUTPUT  -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
   iptables -A INPUT -p tcp -m tcp -j REJECT
share|improve this question
    
I just read something about allowing DNS - added port 53 in and out rules and still not working. –  CHinAU Apr 14 '13 at 5:31
    
DNS needs both UDP and TCP enabled –  AlexD Apr 14 '13 at 5:31
    
Which mta are you using? What does it log when it fails? –  Iain Apr 14 '13 at 5:37
    
@CHinSU better update your question. Also, your rules for incoming DNS traffic is incorrect - you are specifying dport as 53, you need to use state to allow incoming traffic. –  AlexD Apr 14 '13 at 5:52
add comment

1 Answer 1

up vote 0 down vote accepted

Sendmail-8.12+ passes "command line emails" via 127.0.0.1:25. It does it to avoid being installed as set root uid.

You can make sendmail accept incoming SMTP connection only on 127.0.0.1 (loopback interfaces). It should block incoming external SMTP connections.
Add the following line to sendail.mc and recopile it into sendmail.cf [1]:

DAEMON_OPTIONS(`Addr=127.0.0.1,Port=smtp,Name=MTA')

You may also try the following iptables rules:

iptables -A INPUT -p tcp --dport 25 -d 127.0.0.1 -i lo -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp --dport 25 -m state --state NEW -j REJECT 
iptables -A INPUT -p tcp --dport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp -j REJECT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.