Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Question here regarding iptables.

I have ports 465 and 587 open in the OUTPUT chain for my iptables. However, trying to do a telnet smtp.gmail.com 465 or telnet smtp.gmail.com 587 from my Fedora Core 10 server, no luck, times out.

Yet, when I try the same telnet sequence without iptables running, I'm connected instantly.

Anyway, thanks if anyone is able to help. The 1.2.3.4 is my static home ip to get to the server (changed of course).

Chain INPUT (policy ACCEPT 1375 packets, 161K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  210 17483 ACCEPT     all  --  any    any     1.2.3.4  anywhere            state NEW,RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             serverA.myserver.com   tcp dpt:smtps 
    0     0 ACCEPT     tcp  --  any    any     1.2.3.4  serverA.myserver.com   tcp dpt:mysql 
    0     0 ACCEPT     tcp  --  any    any     1.2.3.4  serverA.myserver.com   tcp dpt:ndmp 
    0     0 ACCEPT     tcp  --  any    any     localhost.localdomain  anywhere            tcp dpt:mysql 
    0     0 ACCEPT     udp  --  any    any     localhost.localdomain  anywhere            udp dpt:mysql 
   29  3442 ACCEPT     all  --  any    any     hostingco.ipsubnet/24       serverA.myserver.com   
   36  2052 ACCEPT     tcp  --  any    any     anywhere             serverA.myserver.com   tcp dpt:http 
    0     0 ACCEPT     tcp  --  any    any     anywhere             serverA.myserver.com   tcp dpt:https 
    0     0 ACCEPT     icmp --  any    any     anywhere             serverA.myserver.com   
  152  7920 REJECT     all  --  any    any     anywhere             serverA.myserver.com   reject-with icmp-port-unreachable 
    0     0 ACCEPT     tcp  --  any    any     1.2.3.4  anywhere            tcp dpt:mysql state NEW,ESTABLISHED 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 392 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   29  2490 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:domain 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:domain 
    2   120 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtp 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtps 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:submission 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ftp-data 
  320 33300 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:telnet 
    0     0 ACCEPT     tcp  --  any    eth0    anywhere             anywhere            tcp spt:smtps dpt:smtps 
share|improve this question
3  
Post the output if iptables -L please. It sounds like your rules are in the wrong order. –  rodjek Dec 7 '09 at 4:45
    
iptables -L -nv will give more detail. –  pjd Dec 7 '09 at 6:07
    
Thanks so far for the comments and posted my iptables. Had some problems but found the <pre> tags for the output to not be garbled as it was before. –  miamisoftware Dec 7 '09 at 7:22

2 Answers 2

up vote 4 down vote accepted

can it be that you accept outgoing packets:

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT

but your input policy is DROP and you dont accept packets that are responses to your queries? make sure your input chain contains [for performance benefits - as first instruction]:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

?

share|improve this answer
    
pQd, I don't think that is my first rule or even any rule. I'll try that and hope it helps. I'm quite new to iptables but trying to read and implement as best I can. Thanks again. –  miamisoftware Dec 7 '09 at 7:28
    
pQd, that did it. But if you're still online, quick question. Would that first rule, open up my INPUT table to anything or would the others below then filter out the rest? –  miamisoftware Dec 7 '09 at 7:37
    
@miamisoftware - this will open your input only for packets which are responses to connections you open or to related connections [ eg data transfer for ftp ]. up to my knowledge this is not a security threat. –  pQd Dec 7 '09 at 10:10
    
Thanks a lot pQd, that did the trick - accurate answer and explanation was great. –  miamisoftware Dec 7 '09 at 17:24

Try adding a log to the output queue rule:

-A OUTPUT -j LOG --log-prefix "BLOCK_OUT: " --log-level info
-A OUTPUT -j REJECT

You will then be able to watch /var/log/messages (grep for BLOCK_OUT) to see what iptables is dropping.

If you are using:

telnet smtp.gmail.com 465

(nslookup/dig smtp.gmail.com would also fail)

then I suspect you'll end up needing at least some rules to pass DNS out:

 -A OUTPUT -p tcp --dport 53 -j ACCEPT
 -A OUTPUT -p udp --dport 53 -j ACCEPT

Use tools like "nmap" to check that your ruleset is really doing what you want it to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.