0

for some time now I am not able to reach SMTP on port 25 or 587 on a server of mine from the outside though both ports are open and postfix is listening on them:

$ telnet domain.tld 25
Telnet escape character is '^]'.
Trying *.*.*.*...
telnet: Unable to connect to remote host: Connection timed out

$ iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N fail2ban-ssh
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A fail2ban-ssh -j RETURN

$ netstat -anpt | grep master
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      1081/master
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      1081/master

Sending mails from the server itself works (through command line & web interface) and fetching mails through IMAP is also possible.

Any suggestions?

  • Have you talked with your provider? They may be blocking those ports. – EEAA Dec 1 '15 at 18:45
  • I don't think so. It's a root server with an option to use Plesk including mails. And for my local network I can connect to the same ports on other server so I don't think that some firewall is blocking this of. – Dero Dec 1 '15 at 18:57
  • 1
    My question stands. Don't make assumptions. Ask them. – EEAA Dec 1 '15 at 19:07
2
tcptraceroute mydomain 25 

will tell you which host is blocking port 25 (compared to mtr or traceroute mydomain)

| improve this answer | |
  • Thanks. That helped me. Traceroute for port 25 stopped at my new router. It has some "secure mail server" list integrated and SMTP access is by default only granted for those servers. Deactivating that list helped. – Dero Dec 1 '15 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.