0

I have a CentOS box running exim, I am trying to restrict outbound emails only to one domain (lets say domain.com) and block mails to all other domains. I have added a specific rules to allow outbound mails to domain.com (line numbers 6,7 & 8) and the default action for output chain is block. But still mails are sent out to gmail, yahoo and other domains. What is wrong in my iptables rules?

Below are the outbound rules

    root@host1 [/tmp/logd]# /sbin/iptables -L OUTPUT -n --line-number -v
    Chain OUTPUT (policy DROP 0 packets, 0 bytes)
    num   pkts bytes target     prot opt in     out     source               destination
    1        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.x.x.x      /* test */
    2     3455  420K ACCEPT     tcp  --  *      *       0.0.0.0/0            23.x.x.x      tcp dpt:443
    3        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            104.x.x.x       tcp dpt:80
    4        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            104.x.x.x       tcp dpt:80
    5      0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            104.20.5.21         tcp dpt:80 /* www.spamhaus.org */
    6      0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            216.x.x.x      tcp dpt:25 /* allow mails to domain.com */
    7     69 16484 ACCEPT     tcp  --  *      *       0.0.0.0/0            216.x.x.x      tcp dpt:25 /* allow mails to domain.com */
    8     68 10803 ACCEPT     tcp  --  *      *       0.0.0.0/0            173.x.x.x      tcp dpt:25 /* allow mails to domain.com */
    9   800K  826M LOCALOUTPUT  all  --  *      !lo     0.0.0.0/0            0.0.0.0/0
    10      0     0 ACCEPT     tcp  --  *      !lo     0.0.0.0/0            0.0.0.0/0           tcp dpt:53
    11      0     0 ACCEPT     udp  --  *      !lo     0.0.0.0/0            0.0.0.0/0           udp dpt:53
    12      9   536 ACCEPT     tcp  --  *      !lo     0.0.0.0/0            0.0.0.0/0           tcp spt:53
    13   2147  313K ACCEPT     udp  --  *      !lo     0.0.0.0/0            0.0.0.0/0           udp spt:53
    14  11324   17M ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
    15   797K  826M INVALID    tcp  --  *      !lo     0.0.0.0/0            0.0.0.0/0
    16   797K  826M ACCEPT     all  --  *      !lo     0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    17      0     0 ACCEPT     icmp --  *      !lo     0.0.0.0/0            0.0.0.0/0           icmp type 0
    18      0     0 ACCEPT     icmp --  *      !lo     0.0.0.0/0            0.0.0.0/0           icmp type 8
    29      0     0 ACCEPT     icmp --  *      !lo     0.0.0.0/0            0.0.0.0/0           icmp type 11
    20      0     0 ACCEPT     icmp --  *      !lo     0.0.0.0/0            0.0.0.0/0           icmp type 3
    21    372 25376 LOGDROPOUT  all  --  *      !lo     0.0.0.0/0            0.0.0.0/0
1
  • What is the chain LOCALOUTPUT doing? sbin/iptables -L LOCALOUTPUT -n --line-number -v – HBruijn Sep 10 '18 at 2:24
2

I don't know if you also have IPv6 on this box? If so, exim will try to send over IPv6 per default, before it falls back to IPv4. But I think the problem here isn't iptables per se, but in the way of how those domains are handled and looked up. It's almost impossible to filter based on IP address as bigger companies have various routing and BGP tricks to lower latency and how traffic is routed to their domains.

I would instead suggest that you configure exim4 to only send emails to your allowed outgoing domains, and then drop to anything else, maybe with something like this: Blocking outgoing mails to some users in exim

1

I think that your general idea of how to do this is wrong. Such subjects typically are filling books, but I'll try to explain shortly:

You probably assume that the mail server for domain.com is at the same IP address as domain.com itself. While this accidentally might be true in some (or even many) cases, it not true in general.

Rather, there are entries in a domain's DNS records which determine which server (IP address) handles mail for the domain. You might already have seen DNS records like this:

domain.com.        1H MX 50    mail.domain.com
domain.com.        1H IN A     2.3.4.5
mail.domain.com    1H IN A     1.2.3.4

This means that the mail server (e.g. mail.domain.com) for domain.com could be at a different IP address than domain.com itself.

Now, if you send email from your email software program (also called MUA - mail user agent), the MUA delivers the message to Exim. When Exim tries to relay the message to the recipient, it first looks up the mail server which will handle the mail for the recipient's domain, and then tries to connect to that server and to deliver the message there.

This means that your method even could prevent you from sending any email. Suppose domain.com resolves to 1.1.1.1, but the mail server of domain.com is at (or resolves) to 2.2.2.2. Since your firewall lets pass traffic only to 1.1.1.1, you can't send any email even to domain.com, because email to domain.com would have to be delivered to 2.2.2.2.

This is only one of various reasons why you shouldn't use the firewall to achieve your goal. As @Fredrik Lundhag said, you should configure Exim accordingly instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.