Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set a postfix + cyrus-sasl + cyrus-imapd mail server on my CentOS 6.5 x64 server. After I finished the settings, I found that I can send internal emails and send emails to other mailboxes like Gmail. But I can't receive my reply from Gmail and mxtoolbox diagnosed as 'Unable to Connect to SMTP Host' (time-out after 15 senconds). I can't telnet myipaddress 25 either. Here is what I did and I have no idea what is wrong. Please help and thanks.

vim /etc/postfix/  
myhostname =  
mydomain =  
myorigin = $mydomain  
inet_interfaces = all  
mydestination = $myhostname, localhost.$mydomain, localhost,$mydomain
mynetworks =,  
local_recipient_maps =    
smtpd_banner = $myhostname ESMTP unknow       
smtpd_sasl_auth_enable = yes   
broken_sasl_auth_clients = yes  
smtpd_sasl_local_domain = $myhostname  
smtpd_sasl_security_options = noanonymous 
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination  
smtpd_sasl_security_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination  
message_size_limit = 15728640

vim /etc/sasl2/smtpd.conf
log_level: 3

vim /etc/sysconfig/iptables
-A INPUT -p TCP -i $EXTIF --dport 25 --sport 1024:65534 -j ACCEPT
-A INPUT -p TCP -i $EXTIF --dport 993 --sport 1024:65534 -j ACCEPT
-A INPUT -p TCP -i $EXTIF --dport 995 --sport 1024:65534 -j ACCEPT

/etc/init.d/postfix start  
/etc/init.d/saslauthd start  
/etc/init.d/cyrus-imapd start

netstat -tpnl | grep smtpd
netstat -tpnl | grep :25
tcp        0      0        *                   LISTEN      1698/master
netstat -tpnl | grep cyrus
tcp        0      0       *                   LISTEN      3432/cyrus-master   
tcp        0      0       *                   LISTEN      3432/cyrus-master   
tcp        0      0      *                   LISTEN      3432/cyrus-master   
tcp        0      0       *                   LISTEN      3432/cyrus-master   
tcp        0      0       *                   LISTEN      3432/cyrus-master   
tcp        0      0 :::110                      :::*                        LISTEN      3432/cyrus-master   
tcp        0      0 :::143                      :::*                        LISTEN      3432/cyrus-master   
tcp        0      0 :::4190                     :::*                        LISTEN      3432/cyrus-master   
tcp        0      0 :::993                      :::*                        LISTEN      3432/cyrus-master   
tcp        0      0 :::995                      :::*                        LISTEN      3432/cyrus-master
share|improve this question
If you disable iptables temporarily, does it work? – NickW Jan 9 '14 at 15:48
Yes I can telnet it, but I don't understand...I've already set port 25 open in the iptables and restarted it to make the new rules into effect. And also 'netstat -tpnl | grep smtpd' returns nothing, there should be something like tcp 0 0* LISTEN 6319/smtpd, right? And I still can't receive replies from Gmail. – leoce Jan 9 '14 at 15:56
All I see is local IPs. What is your public IP? Is it static? Is it NATted? Have you put the proper NAT/port forwarding on the border router? Is your public IP address properly published, in the DNS, as the MX for your domain? – Alien Life Form Jan 9 '14 at 15:57
Yes, I just updated my question and I don't have enough reputations to post pictures, so I put the pic link there. Hope it helps. – leoce Jan 9 '14 at 16:01
Master is the name of the process that does the actual listening for postfix, that's why the file to configure it, and other listeners, is called – NickW Jan 9 '14 at 16:04
up vote 0 down vote accepted

NickW answered your question right off the bat. Since you can telnet to it when iptables is turned off but not when it's on the problem is the firewall. NickW is correct on his second comment too that the process should be "master" and not smtp but by default postfix should listen on port 25.

When I do a telnet right now I get this:

# telnet 25
telnet: Unable to connect to remote host: No route to host

If your install is a default CentOS install then one of the "reject" statements in iptables may look like this:

REJECT --reject-with icmp-host-prohibited

When a server rejects with 'icmp-host-prohibited' it sends the 'No route to host' statement to the client. From your iptables output that you gave us (giving the output of iptables -L would help us more) I don't think that the "-i" or "--sport" options are needed.

share|improve this answer
Also, if your postfix server has a 192.168.x.x address then you are NAT'd and behind a router which means you need to make sure port 25 is opened on the routers firewall to the postfix server. – skabople Jan 9 '14 at 16:42
Thanks @skabople ! I found two lines like you said: -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited and I've commented them out. Still I can't receive emails but I'll follow your advice and figure it out. Many thanks! – leoce Jan 9 '14 at 17:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.