Dear Everyone, First of all my apologies for this lengthy email, but below is my entire rule, and I am not sure where in this my problem lies. I am trying to build a ruleset for a mailserver - thats all. If I start iptables with the below ruleset, (/etc/rc.d/init.d/iptables start), the output of iptables -nvL |grep "tcp dpt:25" is: 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 0 0 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 The output of iptables -nvL |grep "tcp dpt:110" is: 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 0 0 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 So as far as I can tell this should allow me to send and receive emails through this server. When I try to do that however, I only get "Unable to connect to server" from my outlook client. If I stop the firewall (/etc/rc.d/init.d/iptables stop), I can send and receive emails through that sevrer no problems. If anybody with the neccessary experience could have a look and possibly point out where the problem lies I would very much appreciate it. many thanks, and Kind Regards... # -------------------------------------------------------------------------- -- # # Invoked from /etc/rc.d/init.d/iptables. # chkconfig: - 60 95 # description: Starts and stops the IPTABLES packet filter \ # used to provide firewall network services. # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. if [ ${NETWORKING} = "no" ] then exit 0 fi if [ ! -x /sbin/iptables ]; then exit 0 fi # See how we were called. case "$1" in start) echo -n "Starting Firewalling: " # -------------------------------------------------------------------------- -- # Some definitions for easy maintenance. IPADDR="10.2.0.28" EXTERNAL_INTERFACE="eth0" # Internet connected interface LOOPBACK_INTERFACE="lo" # Your local naming convention PRIMARY_NAMESERVER="212.120.66.194" # Your Primary Name Server SECONDARY_NAMESERVER="212.120.66.195" # Your Secondary Name Server LOOPBACK="127.0.0.0/8" # Reserved loopback addr range CLASS_A="10.0.0.0/8" # Class A private networks CLASS_B="172.16.0.0/12" # Class B private networks CLASS_C="192.168.0.0/16" # Class C private networks CLASS_D_MULTICAST="224.0.0.0/4" # Class D multicast addr CLASS_E_RESERVED_NET="240.0.0.0/5" # Class E reserved addr BROADCAST_SRC="0.0.0.0" # Broadcast source addr BROADCAST_DEST="255.255.255.255" # Broadcast destination addr PRIVPORTS="0:1023" # Privileged port range UNPRIVPORTS="1024:" # Unprivileged port range # -------------------------------------------------------------------------- -- # The SSH client starts at 1023 and works down to 513 for each # additional simultaneous connection originating from a privileged port. # Clients can optionally be configured to use only unprivileged ports. SSH_LOCAL_PORTS="1022:65535" # Port range for local clients SSH_REMOTE_PORTS="1:65535" # Port range for remote clients # traceroute usually uses -S 32769:65535 -D 33434:33523 TRACEROUTE_SRC_PORTS="32769:65535" TRACEROUTE_DEST_PORTS="33434:33523" # -------------------------------------------------------------------------- -- # Default policy is DENY # Explicitly accept desired INCOMING & OUTGOING connections # Remove all existing rules belonging to this filter iptables -F # Remove any existing user-defined chains. iptables -X # Set the default policy of the filter to deny. iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # -------------------------------------------------------------------------- -- # LOOPBACK # -------- # Unlimited traffic on the loopback interface. iptables -A INPUT -i $LOOPBACK_INTERFACE -j ACCEPT iptables -A OUTPUT -o $LOOPBACK_INTERFACE -j ACCEPT # # # # -------------------------------------------------------------------------- -- # SPOOFING & BAD ADDRESSES # Refuse spoofed packets. # Ignore blatantly illegal source addresses. # Protect yourself from sending to bad addresses. # Refuse incoming packets pretending to be from the external address. iptables -A INPUT -s $IPADDR -j DROP # Refuse incoming packets claiming to be from a Class A, B or C private ##network iptables -A INPUT -s $CLASS_A -j DROP iptables -A INPUT -s $CLASS_B -j DROP iptables -A INPUT -s $CLASS_C -j DROP # Refuse broadcast address SOURCE packets iptables -A INPUT -s $BROADCAST_DEST -j DROP iptables -A INPUT -d $BROADCAST_SRC -j DROP # Refuse Class D multicast addresses # Multicast is illegal as a source address. # Multicast uses UDP. iptables -A INPUT -s $CLASS_D_MULTICAST -j DROP # Refuse Class E reserved IP addresses iptables -A INPUT -s $CLASS_E_RESERVED_NET -j DROP # Refuse special addresses defined as reserved by the IANA. # Note: The remaining reserved addresses are not included # filtering them causes problems as reserved blocks are # being allocated more often now. The following are based on # reservations as listed by IANA as of 2001/01/04. Please regularly # check at http://www.iana.org/ for the latest status. # Note: this list includes the loopback, multicast, & reserved addresses. # 0.*.*.* - Can't be blocked for DHCP users. # 127.*.*.* - LoopBack # 169.254.*.* - Link Local Networks # 192.0.2.* - TEST-NET # 224-255.*.*.* - Classes D & E, plus unallocated. iptables -A INPUT -s 0.0.0.0/8 -j DROP iptables -A INPUT -s 127.0.0.0/8 -j DROP iptables -A INPUT -s 169.254.0.0/16 -j DROP iptables -A INPUT -s 192.0.2.0/24 -j DROP iptables -A INPUT -s 224.0.0.0/3 -j DROP # # # # -------------------------------------------------------------------------- -- # UDP TRACEROUTE # -------------- # traceroute usually uses -S 32769:65535 -D 33434:33523 iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \ --source-port $TRACEROUTE_SRC_PORTS \ -d $IPADDR --destination-port $TRACEROUTE_DEST_PORTS -j DROP iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \ -s $IPADDR --source-port $TRACEROUTE_SRC_PORTS \ --destination-port $TRACEROUTE_DEST_PORTS -j ACCEPT # # # # -------------------------------------------------------------------------- -- # DNS forward-only nameserver # --------------------------- iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \ -s $PRIMARY_NAMESERVER --source-port 53 \ -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \ -s $IPADDR --source-port $UNPRIVPORTS \ -d $PRIMARY_NAMESERVER --destination-port 53 -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn \ -s $PRIMARY_NAMESERVER --source-port 53 \ -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR --source-port $UNPRIVPORTS \ -d $PRIMARY_NAMESERVER --destination-port 53 -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \ -s $SECONDARY_NAMESERVER --source-port 53 \ -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \ -s $IPADDR --source-port $UNPRIVPORTS \ -d $SECONDARY_NAMESERVER --destination-port 53 -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn \ -s $SECONDARY_NAMESERVER --source-port 53 \ -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR --source-port $UNPRIVPORTS \ -d $SECONDARY_NAMESERVER --destination-port 53 -j ACCEPT # # # # ------------------------------------------------------------------ # POP server (110) # ---------------- iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp \ --source-port $UNPRIVPORTS \ -d $IPADDR --destination-port 110 -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp ! --syn \ -s $IPADDR --source-port 110 \ --destination-port $UNPRIVPORTS -j ACCEPT # POP client (110) # ---------------- iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn \ --source-port 110 \ -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR --source-port $UNPRIVPORTS \ --destination-port 110 -j ACCEPT # # # # ------------------------------------------------------------------ # SMTP server (25) # ---------------- iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp \ --source-port $UNPRIVPORTS \ -d $IPADDR --destination-port 25 -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp ! --syn \ -s $IPADDR --source-port 25 \ --destination-port $UNPRIVPORTS -j ACCEPT # # # # ------------------------------------------------------------------ # SMTP client (25) # ---------------- iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn \ --source-port 25 \ -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR --source-port $UNPRIVPORTS \ --destination-port 25 -j ACCEPT # # # # ------------------------------------------------------------------ # SSH server (22) # --------------- # iptables -I INPUT -i $EXTERNAL_INTERFACE -p tcp --dport 22 --sport 1024:65535 -j ACCEPT iptables -I OUTPUT -p tcp --sport 22 -j ACCEPT # # # -------------------------------------------------------------------------- -- # ICMP # ---- # To prevent denial of service attacks based on ICMP bombs, filter # incoming Redirect (5) and outgoing Destination Unreachable (3). # Note, however, disabling Destination Unreachable (3) is not # advisable, as it is used to negotiate packet fragment size. # For bi-directional ping. # Message Types: Echo_Reply (0), Echo_Request (8) # To prevent attacks, limit the src addresses to your ISP range. # # For outgoing traceroute. # Message Types: INCOMING Dest_Unreachable (3), Time_Exceeded (11) # default UDP base: 33434 to base+nhops-1 # # For incoming traceroute. # Message Types: OUTGOING Dest_Unreachable (3), Time_Exceeded (11) # To block this, deny OUTGOING 3 and 11 # 0: echo-reply (pong) # 3: destination-unreachable, port-unreachable, fragmentation-needed, etc. # 4: source-quench # 5: redirect # 8: echo-request (ping) # 11: time-exceeded # 12: parameter-problem iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type echo-reply \ -d $IPADDR -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type destination-unreachable \ -d $IPADDR -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type source-quench \ -d $IPADDR -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type time-exceeded \ -d $IPADDR -j ACCEPT iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type parameter-problem \ -d $IPADDR -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp \ -s $IPADDR --icmp-type fragmentation-needed -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp \ -s $IPADDR --icmp-type source-quench -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp \ -s $IPADDR --icmp-type echo-request -j ACCEPT iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp \ -s $IPADDR --icmp-type parameter-problem -j ACCEPT # # # # -------------------------------------------------------------------------- -- # Enable logging for selected denied packets iptables -A INPUT -i $EXTERNAL_INTERFACE -p tcp -j DROP iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \ --destination-port $PRIVPORTS -j DROP iptables -A INPUT -i $EXTERNAL_INTERFACE -p udp \ --destination-port $UNPRIVPORTS -j DROP iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type 5 -j DROP iptables -A INPUT -i $EXTERNAL_INTERFACE -p icmp \ --icmp-type 13/255 -j DROP iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j REJECT # -------------------------------------------------------------------------- -- ;; stop) echo -n "Shutting Firewalling: " # Remove all existing rules belonging to this filter iptables -F # Delete all user-defined chain to this filter iptables -X # Reset the default policy of the filter to accept. iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT ;; status) status iptables ;; restart|reload) $0 stop $0 start ;; *) echo "Usage: iptables {start|stop|status|restart|reload}" exit 1 esac echo "done" exit 0