I updated my iptables in Ubuntu 10.04, but it doesn't seem to be having any affect on the opened ports.

When I run iptables --list, the following line shows up

Chain INPUT (policy DROP)
target   prot opt source              destination
ACCEPT   all  --  anywhere            anywhere         tcp dpt:smtp

However, when I try to do a port scan to see if port 25 is open, it responds as closed. Could there be something further upstream that is blocking the port? Or do I need to do something to 'restart' the firewall after modifying the IP tables?

Linux Noob here if it doesn't quite come through ...

  • Is there a service listening on port 25? Can you also post the contents of your OUTPUT chain? – Zoredache Jul 16 '10 at 0:09
  • I have exim4 running (which I assumed -- probably incorrectly -- to be listening on port 25). How do I get my output chain? – jerhinesmith Jul 16 '10 at 1:29

If netstat -tapnl | grep 25 doesn't return something like 0:0:0:0:25 (or the paticular IP you query) it means nothing is listening on that port and IPTables is not the problem -- or at least not the only problem.

  • It doesn't. I'm thinking that I need to re-run the exim4 configuration and tell it to listen for all incoming requests. Currently it looks like it's configured for only and ::1. – jerhinesmith Jul 16 '10 at 12:51

It probably responds as closed because you don't have a service listening on that port.


Some Linux distros(I'm looking at my RHEL install primarily) set sendmail to listen only on localhost. So if I was doing my portscan from another computer, it would return as closed.

Also, some ISPs(I'm looking at my Cox here) will block inbound 25. So if I was scanning from a web-based scanner like GRC's Shields Up, it will return as if I had set it to DROP instead of accept. They do this as a way of combating spam on the whole Internet. Your ISP might have a policy to send back a port closed message instead of letting you answer it.

  • Yup. RHEL does that on the default install to prevent inexperienced users from making an open mail relay. – RHELAdmin Jul 16 '10 at 0:43

The earlier suggestion that you don't have a service listening on port 25 is the most likely.

Another suggestion is to verify both the rules and the interfaces. For example, run:

iptables -L -v

will also show the interfaces. Hence there can be different rules for different interfaces (especially the lo interface that will typically be ACCEPT for all traffic).


Just to provide a little more information about the use of netstat. The command line option -p (as suggested above) will cause netstat to display the program that is associated with the socket/port. In this case exim should show up in the output indicating that is is responsible for the port 25 connection. But, there is a slightly subtle detail about the use of this option. Due to security netstat will only show you program names for applications you own. So if your not already doing your testing as root netstat will not show you what application owns port 25. In general one should not get into the habit of running around as root, but in this case it is a helpful step.

Another detail somewhat related here is the use of telnet. This application is an often missed network analysis tool. A very fast test to see if port 25 is doing anything is to just telnet into it (this works great for any number of other service ports). Try telneting to localhost,, your IP and your hostname. The reason I point this out is that exim might well be runing and might well have opened port 25 in some fashion, but if something is broken about exim (say somebody messed with the config file in an ungraceful way) the use of netstat will not tell you port 25 is not talking. And, a quick telnet in will.

If you want to feel unixy old school you can use nc for the same purpose. Or, if you prefer the sledge hammer approach look at the man page for nmap (I actually do not recommend looking at this man page for a newer user though, nmap is hideously complicated). And for more fun, try telneting into the ssh port, it's instructive.



$ lsof -i :25

If you don't get any results you don't have a mail server running (or any type of service running on that port).


I remember having a similar problem with postfix. Although postfix was running, port scanning did not show port 25 as open. The problem was the following line was commented in the file


smtp      inet  n       -       -       -       -       smtpd

uncomment it.

Chain INPUT (policy DROP)
target   prot opt source              destination
ACCEPT   all  --  anywhere            anywhere         tcp dpt:smtp

What connections have to be allowed? What is already allowed?

  • SYN - Inbound, Allowed
  • SYN/ACK - Outbound, check OUTPUT chain -> ACCEPT?
  • ACK - Inbound, Allowed
  • Data Connection - Doesn't run on port 25. Which means to allow this traffic we have to make a rule which also accepts the RELATED or ESTABLISHED connections.

Basically you can change your rule to the following:

iptables -A INPUT -p tcp --dport 25 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.