I am trying to secure my vps server running ubuntu HardyHeron (8.04 lts). I am using iptables to block almost all incoming traffic. I wish to allow the following:

  • Web traffic (80 & 443)
  • mail traffic (incoming and outgoing, 25?)
  • all traffic from my home pc (I have a static ip)

Everything works great except mail. I have not yet tested incoming mail, but outgoing mail appears to be blocked when I load the chain. I have several web pages that email confirmations and those confirmations are blocked when I load the rules, but work fine when I don't have any rules. here are the rules (output from iptables -L)

target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     all  --        anywhere            #fake ip, but allows all traffic from my home pc
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I don't understand why the mail is blocked so I'd appreciate help on that and also what specifically to add to allow the outgoing mail.

  • So what's in the logs? – womble Nov 22 '09 at 15:18
  • Just trying to figure out why things were not working - but there was too much information. – Scott Nov 24 '09 at 11:49

Your outbound mail will be failing because you are allowing outbound packets, but dropping the inbound replies. The following iptables command will add a rule to accept incoming packets that are part of connections that are already established:

iptables --insert INPUT 1 -m state --state ESTABLISHED --jump ACCEPT

You may also want to allow new inbound connections that are related to established connections (e.g. for FTP when it opens a new connection and for ICMP errors). You can do this by changing ESTABLISHED in the above line to ESTABLISHED,RELATED.


I use a bit of a different syntax then the above. Whereas the first responder wrote:

iptables --insert INPUT 1 -m state --state ESTABLISHED --jump ACCEPT

I prefer:

iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Why make this change? Adding the RELATED state allows you to, for example, receive a larger amount of errors from failed connections. Also, note how I specified the loop back interface (expressed as 'lo') in the first rule with the -i flag? You can specify NICs the sameway, like this:

iptables --insert INPUT 2 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

There is a lot of cool stuff in iptables; I was very grumpy to see it replaced with NFTables and have yet to invest a lot of time with NFT. Soon enough, I guess. Good luck!

  • But -D deletes rules from the firewall! – Michael Hampton Feb 9 '15 at 21:17
  • Michael; editted to correct horrific typo. – Josh Wieder Feb 9 '15 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.