My public server accepts traffic and relays them to other machines on the network with iptables PREROUTING rules. I recently added a mail server at and made its iptables rules to accept port 25 traffic.

-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 

With netstat -nat on the mail server I see it listens to :25

On my public machine, I added a

-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A PREROUTING -i eth1 -p tcp -m tcp --dport 25 -j DNAT --to-destination

rule, yet it does not listen to :25. My university does not allow traffic into its network through :25, so when I telnet locally I get a connection refused error. The university's relay mail server is supposed to relay e-mails to user@site.uni.tld to my mail server (at :25), yet the connection fails

----- Transcript of session follows -----
<user@site.uni.tld>... Deferred: Connection refused by site.uni.tld.
Warning: message still undelivered after 4 hours
Will keep trying until message is 2 weeks old

Final-Recipient: RFC822; user@site.uni.tld
Action: delayed
Status: 4.4.1
Remote-MTA: DNS; site.uni.tld

Any ideas why? The DNS records are fine and have been transferred to the uni relay servers.

  • Can you give us the output of the following, so we can see what IP the MTA is listening on? netstat -an | grep ":25" Jul 15, 2014 at 13:19
  • @furriephillips No output on the main server, and on the mail server: user@mail:~$ netstat -an | grep ":25" tcp 0 0* LISTEN tcp6 0 0 :::25 :::* LISTEN – Jul 15, 2014 at 13:54
  • When you make an iptables DNAT rule, it doesn't make any listening sockets that netstat would show. The DNAT processing happens in a lower level of the network stack inside the kernel. Jul 15, 2014 at 14:13
  • I'm assuming that "I added a mail server" means that the machine on which you're doing the iptables rules is the virtualisation host on which the new mail server image is running. Is that right? If so, you will need a FORWARD rule to ACCEPT the traffic, not an INPUT one.
    – MadHatter
    Jul 15, 2014 at 18:36
  • Two great debugging tools for this are iptables -L -nv which shows hit counts next to each rule and tcpdump -n port 25 which shows packets arriving on port 25 before they are processed by the firewall.
    – Ladadadada
    Jul 16, 2014 at 10:01

1 Answer 1


An iptables PREROUTING rule will not show up in a standard netstat listing, as in NAT mode, it operates at the kernel level, therefore does not register as a process that's listening. The best way for you to diagnose this is to monitor all traffic on that machine on port 25 to see how it behaves with the rules you have in place;

tcpdump -nn -i eth0 port 25

(replacing eth0 with the relevant interface name). This will show you all traffic coming to local port 25, or outbound to port 25 on a remote host (so you can look at it in both directions). If the traffic's not being sent on its merry way, your iptables rule is mangled and needs a closer look. If it is, then the problem's at the remote host.

Edit: forgot to add that you need the MASQUERADE chain setting up in POSTROUTING:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

which will allow your internal device to communicate back with the outside world and reply to its clients.

  • No traffic in port 25. Are my iptables rules wrong then? Jul 15, 2014 at 14:38
  • Not necessarily, it just means that your interface isn't receiving anything on that port. Keep tcpdump running and just telnet to that interface's IP address from another machine. The connect may/will refuse, but you'll at least see the SYN request in tcpdump. I also forgot to mention that you need the MASQUERADE chain setting up in POSTROUTING to allow the internal device to communicate with the outside world.
    – dannosaur
    Jul 15, 2014 at 14:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.