I don't seem to be able to access port 25 on an instance on Amazon EC2. I have opened the port in the security group and in the iptables firewall. I have opened other ports (including 22 and 80) the same way and they work.

On the instance, I can telnet to port 25 and see the output from postfix. From outside EC2 I can telnet to port 22 or port 80 and see the output from the SSH server and the web server. But when I telnet to port 25 from outside EC2 it just sits waiting.

I have filled in the form to be able to send email and had confirmation that that has been done. And I've checked and outgoing email works fine. (All be it through a relay to avoid IP blacklists).

So does Amazon treat incoming traffic to port 25 differently? Does it work fine for other people? Any help appreciated.

As an alternative source of trouble I am using postfix on SUSE Linux (SLES 10) and I am wondering if either of those have some hidden settings that mean they won't respond to port 25 from off the machine. I have checked the iptables settings with iptables -L -nvv and iptables -t nat -L -nvv and I can't see any rules that would get in the way. And postfix does respond to telnet on the localhost.

Edit: When I turn iptables off completely, telnet returns immediately with

telnet: Unable to connect to remote host: Connection refused

As requested by an answer, the contents of master.cf are:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       n       -       -       smtpd
#submission inet n      -       n       -       -       smtpd
#       -o smtpd_etrn_restrictions=reject
#       -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps    inet  n       -       n       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
#submission   inet    n       -       n       -       -       smtpd
#  -o smtpd_etrn_restrictions=reject
#  -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
#628      inet  n       -       n       -       -       qmqpd
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       n       300     1       oqmgr
#tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
smtp      unix  -       -       n       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       n       -       -       smtp
        -o fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
#localhost:10025 inet   n       -       n       -       -       smtpd -o content_filter=
scache    unix  -       -       n       -       1       scache
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
cyrus     unix  -       n       n       -       -       pipe
  user=cyrus argv=/usr/lib/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
procmail  unix  -       n       n       -       -       pipe
  flags=R user=nobody argv=/usr/bin/procmail -t -m /etc/procmailrc ${sender} {recipient}

and grep -v '#' /etc/sysconfig/postfix:

POSTFIX_MAP_LIST="virtual transport access canonical sender_canonical relocated sasl_passwd:600 relay_ccerts"

I've changed the domain at the top, but it is otherwise the same.


When you change a security group of an instance that is already running, it can literally take ages until the changes are applied. Ages means, anything between instantly and hours!

I'd double check your iptables setup:

iptables iptables -nL -v --line-numbers -t filter
iptables iptables -nL -v --line-numbers -t nat
iptables iptables -nL -v --line-numbers -t mangle
iptables iptables -nL -v --line-numbers -t raw

If all is well and it still doesn't work, just relaunch the instance.


I would suggest turning off iptables altogether for a few minutes and testing again - to take that out of the equation. This way you'll either know for sure it has nothing to do with the packet filtering, or it is definitely part of the packet filtering.

Can you also share with us the relevant contents of /etc/postfix/master.cf? (or wherever it is on SUSE linux). It may have been set to not listen on anything but localhost.

I believe the line for smtp should look like this for an internet-facing smtpd:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       n       -       -       smtpd
  • I've added the information you requested. The master.cf does appear to match the line you quote. Any other clues welcome. – Hamish Downer Oct 28 '10 at 15:04
  • I'm not familiar enough with iptables, as I'm more of a BSD user, but if turning off iptables doesn't open up all ports, perhaps try running with an alternative iptables config temporarily that just allows everything. If that still doesn't work, at this point I'm inclined to point to Amazon not having opened port 25 yet. – sandroid Oct 28 '10 at 16:48

This is now working, but thanks to Till and sandroid for their answers. For others wondering, amazon doesn't have anything special about port 25. It would appear that postfix wasn't listening to external addresses. I still haven't worked out why, but ended up installing another MTA and it worked fine.

  • Hi, Thanks for the feedback/update. However, for postfix to not listen on external addresses, the line I mentioned in my initial answer would have to look like " n...." and not "smtp n - ...." - I use postfix alot, so I'm curious what distro you installed this in, and if you know how it is started, for my personal edification. Thanks! – sandroid Nov 1 '10 at 13:57
  • 3
    That is probably an easy fix: Make postfix listen on which means it'll listen on all interfaces. The reason is that you can't make it listen on the "external IP" anyway. And if you bind it to the private (10.x.x.x) interface then it's only -- well private. :) – Till Nov 1 '10 at 14:38
  • ah... I didn't consider being behind NAT... thanks. – sandroid Nov 1 '10 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.