0

I'm setting up a new Postifx server on Debian 12. I've installed the Debian package and confirmed that Postfix is running, and is listening on ports 25,465, and 587.

Postfix is running and there are no errors in the log. I disabled the jails in master.cf and this server does not have a software firewall running.

Postifx is bound to all interfaces, per netstat:

netstat -plnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      8417/master
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN      8417/master         
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      8417/master
tcp6       0      0 :::587                  :::*                    LISTEN      8417/master 
tcp6       0      0 :::465                  :::*                    LISTEN      8417/master         
tcp6       0      0 :::25                   :::*                    LISTEN      8417/master 

I can telnet on the server itself and connect to Postfix via it's public IP:

telnet xx.xx.xx.xx 587
Trying xx.xx.xx.xx...
Connected to xx.xx.xx.xx.
Escape character is '^]'.
220 mydomain.com ESMTP Postfix

But if I try this from outside the server, it won't connect:

telnet mydomain.com 587
Trying xx.xx.xx.xx...
Trying xxxx:xxxx::xxxx:xxxx:xxxx:xxxx...
telnet: Unable to connect to remote host: Network is unreachable

I have confirmed that DNS resolves correctly to the server from the client's perspective.

The ISP at my work/home does not block outgoing ports, as I can telnet to Gmail's SMTP server from home and get to EHLO.

The server hosting company claims that no ports are being blocked.

I can reach the server from my home client with traceroute -I but not without the -I option.

I honestly don't know what else to try. I should be getting something from Postfix when trying to telnet. Most of the options for blocking mail occur after the EHLO, and we haven't gotten that far.

What possible settings on the server would prevent Postifx from listening or responding on the external interface, when netstat shows that it is bound, there are no errors in the log, and Postfix responds to telnet on the server's external IP when telneting from the server itself?

inet_interfaces = all is set. inet_protocols = all is set.

Are there any configuration settings that would cause Postfix to silently drop a connection request without any output at all?

What else can I check or try? Which settings in Postfix would drop or not accept an initial connection request?

8
  • I wrote a relative long debugging guide here serverfault.com/a/1109720/37681
    – HBruijn
    Commented Oct 24, 2023 at 6:13
  • And you tested with the IPv4 address while your telnet response Trying xxxx:xxxx::xxxx:xxxx:xxxx:xxxx.... suggests that you also have at an IPv6 record
    – HBruijn
    Commented Oct 24, 2023 at 6:53
  • @HBruijn: The client tried both the IPv4 and IPv6 in order before timing out.
    – Nick
    Commented Oct 24, 2023 at 7:09
  • Check if you have firewall run on the machine and ports are permitted Commented Oct 24, 2023 at 7:14
  • @RomeoNinov There is no firewall software installed on the server at this time.
    – Nick
    Commented Oct 24, 2023 at 7:38

1 Answer 1

0

Hopefully this helps someone else: apparently there are many different firewalls besides iptables and ucf.

I found this helpful post: https://surgemail.com/knowledge-base/disable-your-firewall/, which lists all of the possibilities to look for. In my case, it was nft.

Here's the full list of firewalls to disable or check for:

nft flush ruleset
systemctl mask nftables.service

systemctl stop firewalld
systemctl disable firewalld

service iptables stop
service iptables disable

service ipchains disable
service ipchains stop

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

cfx -x

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .