Route port 25 to interface eth2

ajaimes · 06-25-2007, 10:11 AM

Hello guys!

I have a network with an internal mail server and a linux proxy. I wonder if there's a way to tell iptables to route all internal SMTP (25) traffic (coming to proxy through eth1) to the external interface eth2?

this is what I have, but does not do the work:

iptables -A INPUT -i eth1 -p tcp --destination-port 25 -j ACCEPT

It's worth to mention that I have two external interfaces (eth2 and eth3) and SMTP traffic should only go out using eth2.

Thank you
Andi.

ajaimes · 06-25-2007, 07:26 PM

Please help me!!!

I have improved my rule but still does not work:

iptables -I FORWARD 1 -p tcp -i eth1 --dport 25 -o eth2 -j ACCEPT

ajaimes · 06-25-2007, 07:34 PM

do you think the reason might be the order in which INPUT, FORWARD and OUTPUT are evaluated? which is the right order?

wildar · 06-25-2007, 07:44 PM

Try it this way:

iptables -A FORWARD -p tcp -i eth1 -o eth2 -s 0/0 --dport 25 -j ACCEPT

manwichmakesameal · 06-25-2007, 07:46 PM

It kinda depends on what rules you have before it. If you have a rule to drop all traffic on a certain port or range of ports on a certain interface, and the port and interface you need is included in that rule, it will be dropped before it even gets to your rule.

ajaimes · 06-25-2007, 07:54 PM

Thank you wildar, but it didn't work mail is still going through eth3... :-(

what do you think about the order idea?

Now I know the correct order is INPUT, FORWARD, OUTPUT so my guess is there should be a rule in INPUT that looks for port 25 and redirects it to FORWARD... I tried doing it but iptables says syntax is wrong:

iptables -I INPUT 1 -p tcp -i eth1 -o eth2 -s 0/0 --dport 25 -j FORWARD

ajaimes · 06-25-2007, 07:59 PM

Hi manwichmakesameal, I have these rules in INPUT:

Chain INPUT (policy DROP)

target prot opt in out source destination
ACCEPT 0 -- * * 192.168.10.0/24 192.168.10.1/24
ACCEPT 0 -- * * 0.0.0.0/24 0.0.0.0/24

what I understand is if this applies first, then all traffic is being manipulated by INPUT and not by FORWARD... am I right?

ajaimes · 06-26-2007, 09:45 AM

Any ideas?

rossonieri#1 · 06-27-2007, 02:39 AM

hi,

why dont you do the inverse operation :
blocking other port to destination 25 - except the one you want.

HTH.