1

I have been running a Centos email/web server for years, with a Linode Xen server the last 4 years with almost no trouble.

Since sometime yesterday I have not been able to connect to outbound email (port 25) servers. The mail queue is building up. Other weird things:

  • I can traceroute on port 25 to gmail servers and complete, but time out when connecting outbound to these servers
  • I just did yum update earlier this afternoon
  • I was getting IPV6 connections trying to be set up until I turned off IPV6 in sysctl
  • I can receive inbound mail on port 25 just fine, just can't forward it out.
  • I'm getting dynamic changes in my iptables, for examples:

    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    DROP       all  --  cpe-188-129-114-96.dynamic.amis.hr  anywhere            
    DROP       all  --  190.40.173.185       anywhere            
    DROP       all  --  5.200.193.129        anywhere            
    DROP       all  --  206.47.254.202       anywhere            
    
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination         
    DROP       all  --  cpe-188-129-114-96.dynamic.amis.hr  anywhere            
    DROP       all  --  190.40.173.185       anywhere            
    DROP       all  --  5.200.193.129        anywhere            
    DROP       all  --  206.47.254.202       anywhere            
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    

Any ideas? Have I been hacked?

1
  • 1) Are you using any dynamic firewall updating thingy, or greylisting? 2) Is it possible that your ISP has blocked outbound port 25 traffic for you?
    – Jenny D
    Jul 1, 2015 at 7:28

1 Answer 1

1

Just a few things

  1. Those are probably spammer addresses but what I think is weird is that the iptables are set to not connect, not to disallow the connection. Maybe you have some sort of security program/firewall/IDS blocking IP addresses?

  2. Consider flushing your iptables and planning out what you think your firewall should look like. If you have a firewall program see if it's interfering. If a bunch of unsavory servers are trying to connect to yours, chances are your server is locking down. I don't see the real benefit in hackers taking out your functionality. Most use SMTP servers to send out spam so they benefit from it functioning.

EDIT: I say those are spammer addresses because the 206.x.x.x address is notorious.

3
  • I talked to the ISP and they are hands-off: no firewalling from them. I also tried flushing iptables and they just came back shortly .... I worked around this by creating a secondary MX host that I'm routing mail through but I would still like to get to the bottom of this. Jul 1, 2015 at 14:52
  • 1
    @MarkMcWiggins where does the traceroute die when you try to traceroute to these servers? Jul 1, 2015 at 19:57
  • Traceroute works (with some apparent delay) but telnet fails: traceroute to alt2.gmail-smtp-in.l.google.com (173.194.219.26), 30 hops max, 60 byte packets 1 23.92.24.2 (23.92.24.2) 0.357 ms 0.528 ms 0.692 ms 2 10ge7-6.core3.fmt2.he.net (65.49.10.217) 0.168 ms 0.180 ms 0.153 ms 3 10ge10-1.core1.sjc2.he.net (184.105.222.14) 6.314 ms 8.659 ms 8.523 ms 12 * * * 13 * * * 19 ya-in-f26.1e100.net (173.194.219.26) 60.338 ms * * -bash-4.1$ telnet alt2.gmail-smtp-in.l.google.com 25 Trying 173.194.219.26... telnet: connect to address 173.194.219.26: Connection timed out Jul 1, 2015 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .