LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 10-27-2007, 05:18 PM   #1
GVaughn
LQ Newbie
 
Registered: Oct 2007
Posts: 2

Rep: Reputation: 0
iptables/sendmail problem


I have sendmail working fine - until I turn on iptables. I have the
following lines in the filters section:
-A INPUT -p tcp -m tcp --dport 25 -j LOG
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT

iptables -L -v gives:
0 0 LOG tcp -- any any anywhere anywhere
tcp dpt:smtp LOG level warning
0 0 ACCEPT tcp -- any any anywhere anywhere
tcp dpt:smtp

The messages log gives this:
Oct 27 13:37:35 fremont-county kernel: IN=eth0 OUT=
MAC=00:50:da:05:cf:70:00:14:95:85:8c:91:08:00 SRC=192.168.0.68
DST=71.39.150.58 LEN=69 TOS=0x00 PREC=0x00 TTL=127 ID=59834 DF PROTO=TCP
SPT=1732 DPT=25 WINDOW=65383 RES=0x00 ACK PSH URGP=0


As soon as I enable iptables mail is no longer accepted. Turning off the
filtering lets it work again.
All of my other ports work fine - 25 is the only problem.

Is there something else I need?
 
Old 10-28-2007, 09:59 AM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Those rules aren't doing any filtering. The log is showing you the packet which was sent to ACCEPT. What you want to see in the log is the opposite - the ones which are getting filtered.
 
Old 10-28-2007, 12:13 PM   #3
rossonieri#1
Member
 
Registered: Jun 2007
Posts: 359

Rep: Reputation: 34
vaughn,

maybe you should post your iptables -nvL
so we can see which rule trigger your problem.
 
Old 10-28-2007, 03:27 PM   #4
GVaughn
LQ Newbie
 
Registered: Oct 2007
Posts: 2

Original Poster
Rep: Reputation: 0
I have solved the problem (at least it is working)

I fiddled with the iptables entries and it started working after I removed the values from the entry ":INPUT ACCEPT [35:2840]" (changed it to ":INPUT ACCEPT [0:0]" - I did the same for the OUTPUT ACCEPT entry.

I was going to post the iptables -nvL output but it is huge (74K).

Thanks for the responses.

Glenn
 
Old 10-28-2007, 04:37 PM   #5
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by GVaughn View Post
I fiddled with the iptables entries and it started working after I removed the values from the entry ":INPUT ACCEPT [35:2840]" (changed it to ":INPUT ACCEPT [0:0]" - I did the same for the OUTPUT ACCEPT entry.
You must have done something else too, as the only thing those changes did is set the packet and byte counters to zero. That would only affect you if you had reached the limit on some sort of quota rules. BTW, I know it's a tough habit to break, but you should really try to abstain from manually editing your iptables configuration file - use an iptables script instead (and let iptables-save be the only one to mess with the config). It is a much less error-prone approach IMHO. Anyhow, it's just a suggestion.
 
  


Reply

Tags
iptables, sendmail


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
sendmail+iptables eranb2 Linux - Networking 3 01-16-2005 05:14 AM
questions on sendmail and iptables aetengoku Linux - Software 4 01-27-2004 10:14 PM
sendmail, iptables and security Tigger Linux - Security 3 11-25-2003 10:14 PM
sendmail, iptables and security Tigger Linux - Newbie 2 05-27-2003 02:37 PM
sendmail, iptables and security Tigger Linux - General 2 05-27-2003 09:45 AM


All times are GMT -5. The time now is 10:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration