cannot send emails to other Web servers

Question

I'm trying to limit my server's open ports in CSF. The IPv4 port settings include:

# Allow incoming TCP ports
TCP_IN = "22,25,53,80,110,143,443,587,3654,53343”

# Allow outgoing TCP ports
TCP_OUT = "22,53,80,113,443,465,995,3654"

# Allow incoming UDP ports
UDP_IN = "53"

# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "53,113,123"

As you see, I have port 25 open in TCP_IN but have removed it from TCP_OUT. The reason is I wanted to have my mails transmitted over smtps, so I have port 465 opened instead in TCP_OUT. Since I am using Rouncube in Directpanel, I have also set the following in Rouncube's config.inc.php:

$config['default_host'] = 'ssl://mail.mydomain.com';
$config['smtp_server'] = 'ssl://mail.mydomain.com';
$config['smtp_port'] = 465;

However, when I remove port 25 from TCP_OUT, I no longer can send mails, say, to gmail, though I can send mails to own. But I can receive all mails.

Please let me know if I need to make any further changes. Do I need to disable port 25 at all, to have my mails sent via ssl.

Thanks

Answer 1

Short Answer:

If your MTA is on the same box, you NEED to be able to connect out to TCP 25.

Long Answer:

SMTP between sites on the internet, uses TCP 25

The encryption is opportunistic (ie, uses STARTTLS). Think about it, not everyone you send email to will support TLS.

So, to send mail to gmail, you need to be able to reach gmail's MXs on TCP 25. For it to be encrypted, both sides have to support STARTTLS. STARTTLS happens opportunistically rather than using a different port. It just so happens that gmail does support STARTTLS, so the connection will automatically upgrade to an encrypted one

Submission doesn't use TCP 25 anyway.

TCP 587 (SMTP-Submission) is for authenticated and optionally encrypted (using STARTTLS) connections from your users.

If you want to require your users to use encryption, that is something you need to configure on your MTA. You can also use TCP 465 for authenticated connections from your users, however 465 uses TLS instead of STARTTLS.

.