I've searched everywhere and I'm really struggling with this one. I think I've tried just about everything.
- VPS with CentOS 6.7
- Postfix 2.6.6
- dovecot, amavis, mysql, fail2ban
- I've verified with my VPS provider that they do not block any ports.
Things I've done
- Removed stock sendmail
- I've installed postfix, dovecot, mysql etc. for a complete mail solution
- I am allowing only imap, smtp with STARTTLS (ports 143 and 587)
- SSH logins disabled, only with keys
- I can receive mails (via port 143)
- I can telnet from localhost to both ports (587, 25) and I get postfix greeting
- Trying to connect to 587 or 25 (mail client or telnet) gets me zero response i.e. connection timeout
Things I've tried
1) Are ports open? Yes, iptables:
Chain INPUT (policy DROP 11 packets, 1375 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 25 2579 f2b-dovecot tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 110,995,143,993,587,465,4190 68 7788 f2b-postfix tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587 0 0 f2b-sshd tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22 25 2579 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 7 600 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 23464 2662K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 49 2940 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3915 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 5 300 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 23235 packets, 2494K bytes) pkts bytes target prot opt in out source destination Chain f2b-dovecot (1 references) pkts bytes target prot opt in out source destination 25 2579 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain f2b-postfix (1 references) pkts bytes target prot opt in out source destination 68 7788 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 Chain f2b-sshd (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
2) Is postfix listening on port 587? Yes. Is it listening on localhost only? No, any host.
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 7173/master tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 917/httpd tcp 0 0 127.0.0.1:4190 0.0.0.0:* LISTEN 749/dovecot tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 7173/master tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 749/dovecot tcp 0 0 127.0.0.1:24 0.0.0.0:* LISTEN 749/dovecot
And here's the postfix/main.cf as well, just in case:
# Enable both IPv4 and/or IPv6: ipv4, ipv6, all. inet_protocols = ipv4 # Enable all network interfaces. inet_interfaces = all
3) Are you forcing secure connections correctly? To the best of my knowledge, yes, here's the postfix/master.cf:
# Submission, port 587, force TLS connection. submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject -o content_filter=smtp-amavis:[127.0.0.1]:10026
4) What about smtpd restrictions? Seems ok:
# HELO restriction smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated reject_non_fqdn_helo_hostname reject_invalid_helo_hostname check_helo_access pcre:/etc/postfix/helo_access.pcre
5) Is postfix even working right?
Yes, logging into server and sending test mail from console works and e-mail is received on the other end, i.e.:
echo "Test mail from postfix" | mail -s "Test Postfix" firstname.lastname@example.org
6) What happens when connecting on port 587?
Apparently, nothing at all. If I try to telnet to any random port, I at least get something. For example, trying to telnet to port 666 (which isn't open) produces no reply to the client, but at least I get something in tcpdump:
15:22:20.305697 IP xxx > xxx.com.mdqs: Flags [S], seq 3195304468, win 8192, options [mss 1352,nop,wscale 8,nop,nop,sackOK], length 0
When tcpdumping port 587, absolutely nothing at all happens when trying to telnet to it.
What am I still missing?
Everything above exhausts my knowledge of the things I can still try. I've managed to nail it down to my port 587 being completely blocked off by something. As I've said, my VPS provider confirmed that they are not blocking any ports at all. I've tried port 25 and it's the same story.
The only other thing I can see is that I have somehow blocked those ports when setting up my server, but I can't recall if that's the case and I don't know how to test for that.
I'd really appreciate any help you can give me. In fact, I'm buying a beer for whoever helps me solve this, I've already wasted two days on it and it's starting to get really annoying.