Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to secure my vps server running ubuntu HardyHeron (8.04 lts). I am using iptables to block almost all incoming traffic. I wish to allow the following:

  • Web traffic (80 & 443)
  • mail traffic (incoming and outgoing, 25?)
  • all traffic from my home pc (I have a static ip)

Everything works great except mail. I have not yet tested incoming mail, but outgoing mail appears to be blocked when I load the chain. I have several web pages that email confirmations and those confirmations are blocked when I load the rules, but work fine when I don't have any rules. here are the rules (output from iptables -L)

target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     all  --  208.69.32.132        anywhere            #fake ip, but allows all traffic from my home pc
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I don't understand why the mail is blocked so I'd appreciate help on that and also what specifically to add to allow the outgoing mail.

share|improve this question
    
So what's in the logs? –  womble Nov 22 '09 at 15:18
    
Just trying to figure out why things were not working - but there was too much information. –  Scott Nov 24 '09 at 11:49
add comment

1 Answer

up vote 2 down vote accepted

Your outbound mail will be failing because you are allowing outbound packets, but dropping the inbound replies. The following iptables command will add a rule to accept incoming packets that are part of connections that are already established:

iptables --insert INPUT 1 -m state --state ESTABLISHED --jump ACCEPT

You may also want to allow new inbound connections that are related to established connections (e.g. for FTP when it opens a new connection and for ICMP errors). You can do this by changing ESTABLISHED in the above line to ESTABLISHED,RELATED.

share|improve this answer
    
thanks - very helpful –  Scott Nov 22 '09 at 16:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.