1

I can't seem to open port 25 on my CentOS 6.3 dedicated server.

telnet localhost 25

works fine, however when trying remotely

telnet mydomain.com 25
Connecting To mydomain.com...Could not open connection to the host, on port 25: Connect failed

This is how my /etc/sysconfig/iptables look like:

# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*raw
:PREROUTING ACCEPT [1239:156878]
:OUTPUT ACCEPT [1017:172599]
COMMIT
# Completed on Tue Dec 11 20:24:48 2012
# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*nat
:PREROUTING ACCEPT [139:41210]
:INPUT ACCEPT [12:976]
:OUTPUT ACCEPT [91:14636]
:POSTROUTING ACCEPT [91:14636]
COMMIT
# Completed on Tue Dec 11 20:24:48 2012
# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*mangle
:PREROUTING ACCEPT [1239:156878]
:INPUT ACCEPT [1239:156878]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1017:172599]
:POSTROUTING ACCEPT [1017:172599]
COMMIT
# Completed on Tue Dec 11 20:24:48 2012
# Generated by iptables-save v1.4.7 on Tue Dec 11 20:24:48 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [107:13896]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Dec 11 20:24:48 2012

I thought that this means my port 25 is open, but it's still not working. Ideas anyone? By the way, /etc/postfix/main.cf says 

inet_interfaces = all

UPDATE:

I have switched the two lines in iptables as suggested, so now:

netstat -tnlp | grep 25

tcp        0      0 0.0.0.0:110                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:143                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      2521/sshd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      6754/master
tcp        0      0 123.123.123.123:25          0.0.0.0:*                   LISTEN      6754/master
tcp        0      0 0.0.0.0:4190                0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:993                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 0.0.0.0:995                 0.0.0.0:*                   LISTEN      2581/dovecot
tcp        0      0 :::110                      :::*                        LISTEN      2581/dovecot
tcp        0      0 :::143                      :::*                        LISTEN      2581/dovecot
tcp        0      0 :::22                       :::*                        LISTEN      2521/sshd
tcp        0      0 :::4190                     :::*                        LISTEN      2581/dovecot
tcp        0      0 :::993                      :::*                        LISTEN      2581/dovecot
tcp        0      0 :::995                      :::*                        LISTEN      2581/dovecot

I take it this means port 25 is open and postfix is listening on it?

My dedicated server provider is OVH and they claim they don't block port 25: http://help.ovh.com/FireWall

This looks like a dead end...

UPDATE 2: Solved, my ISP wasn't blocking port 25, but my VPN provider was. Curse them. Thanks everyone for help.

Improve this question
5
  • It's better to look at the actual running configuration rather than the stored-on-disk configuration. They can differ. In your case: iptables -L -nv, postconf -n and netstat -tlnp. My guess is that it's none of these and your hosting provider is blocking port 25 inbound with their own firewall.
    – Ladadadada
    Dec 11, 2012 at 19:40
  • You are blocking port 25 at the -j REJECT [...] line. Re-add your accept rules with 'iptables -I INPUT 1 -p tcp --dport 25 -j ACCEPT'
    – CloudWeavers
    Dec 11, 2012 at 19:47
  • @CloudWeavers I did so the first time, didn't help
    – Caballero
    Dec 11, 2012 at 19:48
  • 1
    Your server provider might not block port 25, but most home ISPs block customers from connecting to port 25. So if you are testing from home that is probably the issue.
    – Anton Cohen
    Dec 11, 2012 at 19:58
  • Did you reload your iptables service iptables restart ?
    – user9517
    Dec 11, 2012 at 19:59

1 Answer 1

Reset to default
7

The accept line for your port 25

-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT

comes after the blanket reject 

-A INPUT -j REJECT --reject-with icmp-host-prohibited

Switch them round and reload. Iptables works on first match wins so the ACCEPT will never be actioned. The reason you can connect to localhost is that there is a blanket accept

-A INPUT -i lo -j ACCEPT

before the reject.

If that doesn't work, then ckeck postfix is listening on the relevant IP address, check the output of

netstat -tnlp | grep 25

and take approprite action. If it's not that then it's most likely that someone else is blocking port 25 upstream of you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .