basic iptables rules

Question

I am trying to secure my vps server running ubuntu HardyHeron (8.04 lts). I am using iptables to block almost all incoming traffic. I wish to allow the following:

• Web traffic (80 & 443)
• mail traffic (incoming and outgoing, 25?)
• all traffic from my home pc (I have a static ip)

Everything works great except mail. I have not yet tested incoming mail, but outgoing mail appears to be blocked when I load the chain. I have several web pages that email confirmations and those confirmations are blocked when I load the rules, but work fine when I don't have any rules. here are the rules (output from iptables -L)

target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     all  --  208.69.32.132        anywhere            #fake ip, but allows all traffic from my home pc
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I don't understand why the mail is blocked so I'd appreciate help on that and also what specifically to add to allow the outgoing mail.

Answer 1

Your outbound mail will be failing because you are allowing outbound packets, but dropping the inbound replies. The following iptables command will add a rule to accept incoming packets that are part of connections that are already established:

iptables --insert INPUT 1 -m state --state ESTABLISHED --jump ACCEPT

You may also want to allow new inbound connections that are related to established connections (e.g. for FTP when it opens a new connection and for ICMP errors). You can do this by changing ESTABLISHED in the above line to ESTABLISHED,RELATED.