port 25 filtered despite firewall having port 25 open
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
port 25 filtered despite firewall having port 25 open
Almost overnight, our email system stopped sending emails. Upon further checking, port 25 (SMTP) is being filtered. We panicked, and checked the firewall. The firewall shows that port 25 is open, but nmap shows it as "filtered"... Can you look at those and possibly tell us what we've overlooked? The system is a FC5 install.
nmap output:
Code:
Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2007-03-07 10:04 PST
Interesting ports on localhost.localdomain (127.0.0.1):
(The 1665 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
25/tcp filtered smtp
51/tcp open la-maint
80/tcp open http
110/tcp open pop3
143/tcp open imap
443/tcp open https
993/tcp open imaps
50000/tcp open iiimsf
50002/tcp open iiimsf
Nmap finished: 1 IP address (1 host up) scanned in 1.244 seconds
Here's the output from iptables -L:
Code:
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:la-maint
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pop3
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:imap
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:783
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2007-03-07 10:04 PST
Interesting ports on localhost.localdomain (127.0.0.1):
It looks to me that you have run nmap from the host that you are testing on its loopback address. That isn't going to help you. You have to run nmap from a remote host against the normal IP address of the machine being tested.
The first test that you can do is to use telnet to connect to port 25 of that machine from a remote machine. You should see a message indicating that you have connected to the smtp service. If you don't then check to see if your email MTA (Postfix, Sendmail, Qmail, whatever) is configured correctly and that it is running properly.
If you have lost the ability to send email over the Internet but you can still send email within the office then check to see if your ISP is blocking your use of port 25.
Last edited by stress_junkie; 03-07-2007 at 03:09 PM.
I had run nmap locally because nmap from outside of the system doesn't pop up with anything, it just runs forever or gives an error about timing out. Telnet doesn't connect either. I'm not sure, but I think that nmap never returned much of a favorable result from outside; I think FC5's security has it setup to just drop unwanted/filtered traffic. Does the result from iptables look like its attempting to filter? Otherwise, my question is what is causing it to filter port 25?
Email seems to be going at times, albeit slowly. At other times it just stops until the system is rebooted.
So, after trying *one last time* for a nmap from a remote computer, it finally came back with port 25 open and unfiltered. It seems the email on the system is working now (problems *may* have been coming from misconfiguration).
So, why does port 25 still show as filtered on a nmap from inside that computer? At this point its more curiosity than anything else.
Not entirely sure if that sheds some light, but whatever helps!
just wanted to make sure your MTA was listening everywhere... hmmm, weird... the only other thing to look at would be the iptables rules, but the way you posted them it's really hard to understand them... if you could be a little more verbose, like this it would be great:
Code:
iptables -nvL
if there's no rule that would cause nmap to show it as filtered, i'm not sure what the explanation would be... =/
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
