----- Original Message ----- From: Jason Opperisano <opie@xxxxxxxxxxx> Date: Saturday, May 7, 2005 8:17 pm Subject: Re: mails not going thru' > On Sat, May 07, 2005 at 10:14:49AM +0500, varun_saa@xxxxxxxx wrote: > > *filter > > :FORWARD ACCEPT [0:0] > > :INPUT DROP [0:0] > > :OUTPUT ACCEPT [0:0] > > -A INPUT -s 127.0.0.1 -j ACCEPT > > -A INPUT -p tcp -m tcp -i eth1 --dport 3128 --sport 1024:65535 -j > ACCEPT> -A INPUT -p udp -m udp -i eth1 --dport 3128 --sport > 1024:65535 -j ACCEPT > > -A INPUT -s 62.0.0.0/255.0.0.0 -i eth0 -j REJECT > > -A INPUT -p tcp -m tcp -s 217.81.0.0/255.255.0.0 -i eth0 -j REJECT > > -A INPUT -i eth0 -j DROP > > -A INPUT -p tcp -m tcp -i eth1 --sport 80 -j DROP > > -A INPUT -m state -i eth1 --state ESTABLISHED,RELATED -j ACCEPT > > -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT > > -A FORWARD -p tcp -i eth1 -o eth0 --dport 25 --sport 1024: -j > ACCEPT --syn > > -A FORWARD -p tcp -i eth1 -o eth0 --dport 110 --sport 1024: -j > ACCEPT --syn > > -A FORWARD -p tcp -i eth1 -o eth0 --dport 1863 --sport 1024: -j > ACCEPT --syn > > -A FORWARD -p tcp -i eth1 -o eth0 --dport 5050 --sport 1024: -j > ACCEPT --syn > > the policy of your FORWARD chain is set to ACCEPT, so even if there's > traffic you haven't accounted for in these rules--it will still be > allowed through. you have a rule that allows SMTP (TCP 25) out--so i > bet if you type: > > telnet 64.233.185.27 25 [varun@saamail varun]$ telnet 64.233.185.27 25 Trying 64.233.185.27... No response > > which is the IP of gmail's preferred MX, you'd get connected. if > you'reFORWARD policy was DROP, i'd say that the reason you can't > send mail from > a client machine is because you have no rule allowing DNS traffic out: > > -A FORWARD -i eth1 -o eth0 -p udp --sport 1024: --dport 53 -j ACCEPT > -A FORWARD -i eth1 -o eth0 -p tcp --syn --sport 1024: --dport 53 \ > -j ACCEPT > > but since those packets will be accepted by the chain policy, my only > guess is that you do not have any valid DNS servers configured on your > client machines--on a *nix box: > > cat /etc/resolv.conf [varun@saamail varun]$ cat /etc/resolv.conf search saice.edu nameserver 203.145.184.13 # ppp temp entry > > -j > Strange, I can browse but I can't ping ISP gateway and ISP DNS. I can ping ISP gateway and ISP DNS from server. Varun
