My server does not listen to port 25, even though iptables allows smtp traffic [closed]

Question

My public server accepts traffic and relays them to other machines on the network with iptables PREROUTING rules. I recently added a mail server at 192.168.1.10 and made its iptables rules to accept port 25 traffic.

-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 

With netstat -nat on the mail server I see it listens to :25

On my public machine, I added a

-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A PREROUTING -i eth1 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.1.10:25

rule, yet it does not listen to :25. My university does not allow traffic into its network through :25, so when I telnet locally I get a connection refused error. The university's relay mail server is supposed to relay e-mails to user@site.uni.tld to my mail server (at :25), yet the connection fails

----- Transcript of session follows -----
<user@site.uni.tld>... Deferred: Connection refused by site.uni.tld.
Warning: message still undelivered after 4 hours
Will keep trying until message is 2 weeks old

Final-Recipient: RFC822; user@site.uni.tld
Action: delayed
Status: 4.4.1
Remote-MTA: DNS; site.uni.tld

Any ideas why? The DNS records are fine and have been transferred to the uni relay servers.

Answer 1

An iptables PREROUTING rule will not show up in a standard netstat listing, as in NAT mode, it operates at the kernel level, therefore does not register as a process that's listening. The best way for you to diagnose this is to monitor all traffic on that machine on port 25 to see how it behaves with the rules you have in place;

tcpdump -nn -i eth0 port 25

(replacing eth0 with the relevant interface name). This will show you all traffic coming to local port 25, or outbound to port 25 on a remote host (so you can look at it in both directions). If the traffic's not being sent on its merry way, your iptables rule is mangled and needs a closer look. If it is, then the problem's at the remote host.

Edit: forgot to add that you need the MASQUERADE chain setting up in POSTROUTING:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

which will allow your internal device to communicate back with the outside world and reply to its clients.