Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with one of my virtual machines. In my Setup the kvm/libvirt hypervisor acts as the firewall and does all the NAT. There is 1 virtual network (virbr2) for all of the virtual machines.

Operating System: Ubuntu Server 12.04LTS

There is one outgoing interface: eth0

My problem is that one of my virtual machines can't connect to an outside smtp server. I have tried gmail, yahoo, and the one from my university. The curious thing is that while it can't reach any smtp servers it can reach other hosts (outside the lan) on any port.

The Virtual machine has apache, zarafa, and postfix running and can receive mails just fine. Only sending times out.

May 24 15:50:48 mail postfix/smtp[7848]: connect to mailserver.example.com[1.2.3.4]:25: Connection timed out
May 24 15:50:48 mail postfix/smtp[7848]: 2196B320A81: to=<office@example.com>, relay=none, delay=51881, delays=51790/0.06/91/0, dsn=4.4.1, status=deferred (connect to mailserver.example.com[1.2.3.4]:25: Connection timed out)

I have the feeling I am missing something obvious here.

These are my iptables rules. The IP in question is 10.2.3.253

iptables -S; iptables -t nat -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i virbr2 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr2 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr2 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr2 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 16509 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 16509 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5902 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5901 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5903 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT
-A FORWARD -i virbr2 -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 10.2.3.0/24 -o virbr2 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 10.2.3.0/24 -i eth0 -o virbr2 -m state --state RELATED,ESTABLISHED -j    ACCEPT
-A FORWARD -d 10.2.3.0/24 -o virbr2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.2.3.0/24 -i virbr2 -o eth0 -m state --state NEW,RELATED,ESTABLISHED   -j ACCEPT
-A FORWARD -i virbr2 -o virbr2 -j ACCEPT
-A FORWARD -o virbr2 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr2 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A PREROUTING -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.2.3.253:25
-A PREROUTING -p tcp -m tcp --dport 143 -j DNAT --to-destination 10.2.3.253:143
-A PREROUTING -p tcp -m tcp --dport 465 -j DNAT --to-destination 10.2.3.253:465
-A PREROUTING -p tcp -m tcp --dport 587 -j DNAT --to-destination 10.2.3.253:587
-A PREROUTING -p tcp -m tcp --dport 993 -j DNAT --to-destination 10.2.3.253:993
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p tcp -j MASQUERADE
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p udp -j MASQUERADE
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -j MASQUERADE
share|improve this question
    
Is the counter for this rule -A PREROUTING -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.2.3.253:25 incrementing when your virtual host attempts to send mail? –  PP. May 24 '13 at 15:46
1  
Yes weirdly enough it is! (is iptables -t nat -nvL PREROUTING the right command?) –  jo_fryli May 24 '13 at 16:53
    
Can you reach an SMTP server from the host? –  Michael Hampton Jun 9 '13 at 3:10
add comment

1 Answer 1

up vote 0 down vote accepted

I found out what the problem was!

these rules

-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -j MASQUERADE

intercepted with these:

-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p tcp -j MASQUERADE
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -p udp -j MASQUERADE
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -o eth0 -j MASQUERADE

So I had to take out the last three rules.

I dont know how when or why I have put them in there but that solved the problem!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.