SuSEfirewall2 Mail forwarding .. configuration

derrickhackman · 08-11-2004, 11:09 AM

I have been working on this configuration for far too long and need a bit of help. i am running SuSE 9.0 pro and the SuSEfirewall2 on a server that has a public NIC and private NIC (to our internal LAN). what i want to do is 'pass/forward' mail traffic through the firewall to a server on our LAN. I have qmail configured on the internal server and it should be able to receive mail just fine.

basically the network looks like this:

[ internet ] --> [ SuSEfirewall2] --> [ QMail server ]
external NIC internal NIC

the intenal IP of the QMail server is 192.168.0.105 and therefore i have a FW_FORWARD like this (on the firewall server).

FW_FORWARD="127.0.0.1/0,192.168.0.105,tcp,25 127.0.0.1/0,196.168.0.105,tcp,110"

where am i going wrong here? all i need is some good direction.

thanks

bastard23 · 08-12-2004, 01:40 PM

You probably need put it in the masquerading rules. The FW_FORWARD is for routable address, not internal addresses
So maybe:
FW_FORWARD_MASQ="0.0.0.0/0,192.168.0.105,tcp,25 0.0.0.0/0,192.168.0.105,tcp,110"

derrickhackman · 08-12-2004, 03:21 PM

Well, that didnt seem to work, here is my config. Should i be able to do a netstat -l and see the smtp port up? if so, i do not see it. btw, i stripped some of the leading preamble on the config file to meet the size limitations of the site.
Thank you again for your help.

Code:

FW_QUICKMODE="no"
FW_DEV_EXT="eth0"

# 3.)
# Which is the interface that points to the internal network?
#
# Enter all the network devices here which are trusted.
# If you are not connected to a trusted network (e.g. you have just a
# dialup) leave this empty.
#
# Choice: leave empty or any number of devices, seperated by a space
# e.g. "tr0", "eth0 eth1 eth1:1" or ""
#
FW_DEV_INT="eth1"
## Type:	string
#
# 4.)
# Which is the interface that points to the dmz or dialup network?
#
# Enter all the network devices here which point to the dmz/dialups.
# A "dmz" is a special, seperated network, which is only connected to the
# firewall, and should be reachable from the internet to provide services,
# e.g. WWW, Mail, etc. and hence are at risk from attacks.
# See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example.
#
# Special note: You have to configure FW_FORWARD to define the services
# which should be available to the internet and set FW_ROUTE to yes.
#
# Choice: leave empty or any number of devices, seperated by a space
# e.g. "tr0", "eth0 eth1 eth1:1" or ""
#
FW_DEV_DMZ=""

FW_ROUTE="yes"


## Type:	yesno
## Default:	no
#
# 6.)
# Do you want to masquerade internal networks to the outside?
# REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE
#
# "Masquerading" means that all your internal machines which use services on
# the internet seem to come from your firewall.
# Please note that it is more secure to communicate via proxies to the
# internet than masquerading. This option is required for FW_MASQ_NETS and
# FW_FORWARD_MASQ.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_MASQUERADE="yes"

## Type:	string
#
# You must also define on which interface(s) to masquerade on. This is
# normally your external device(s) to the internet.
# Most users can leave the default below.
#
# e.g. "ippp0" or "$FW_DEV_EXT"
FW_MASQ_DEV="no"

## Type:	string
#
# Which internal computers/networks are allowed to access the internet
# directly (not via proxys on the firewall)?
# Only these networks will be allowed access and will be masqueraded!
#
# Choice: leave empty or any number of hosts/networks seperated by a space.
# Every host/network may get a list of allowed services, otherwise everything
# is allowed. A target network, protocol and service is appended by a comma to
# the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with
# unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows
# the 10.0.1.0 network to use www/ftp to the internet.
# "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too.
# Set this variable to "0/0" to allow unrestricted access to the internet.
#
FW_MASQ_NETS=""

## Type:	yesno
## Default:	yes
#
# 7.)
# Do you want to protect the firewall from the internal network?
# REQUIRES: FW_DEV_INT
#
# If you set this to "yes", internal machines may only access services on
# the machine you explicitly allow. They will be also affected from the
# FW_AUTOPROTECT_SERVICES option.
# If you set this to "no", any user can connect (and attack) any service on
# the firewall.
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
# "yes" is a good choice
FW_PROTECT_FROM_INTERNAL="no"

## Type:	yesno
## Default:	yes
#
# 8.)
# Do you want to autoprotect all running network services on the firewall?
#
# If set to "yes", all network access to services TCP and UDP on this machine
# will be prevented (except to those which you explicitly allow, see below:
# FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP})
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_AUTOPROTECT_SERVICES="yes"

## Type:	string
#
# 9.)
# Which services ON THE FIREWALL should be accessible from either the internet
# (or other untrusted networks), the dmz or internal (trusted networks)?
# (see no.13 & 14 if you want to route traffic through the firewall) XXX
#
# Enter all ports or known portnames below, seperated by a space.
# TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and
# UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP.
# e.g. if a webserver on the firewall should be accessible from the internet:
# FW_SERVICES_EXT_TCP="www"
# e.g. if the firewall should receive syslog messages from the dmz:
# FW_SERVICES_DMZ_UDP="syslog"
# For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set
# FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols)
#
# Choice: leave empty or any number of ports, known portnames (from
# /etc/services) and port ranges seperated by a space. Port ranges are
# written like this: allow port 1 to 10 -> "1:10"
# e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514"
# For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2")
#
# Common: smtp domain
FW_SERVICES_EXT_TCP="21 8009 8010 8025 81 8443 9081 9443 http https smtp ssh pop3"

## Type:	string
# Common: domain
FW_SERVICES_EXT_UDP=""
# Common: domain

## Type:	string
# For VPN/Routing which END at the firewall!!
FW_SERVICES_EXT_IP=""

## Type:	string
#
# Common: smtp domain
FW_SERVICES_DMZ_TCP=""

## Type:	string
# Common: domain
FW_SERVICES_DMZ_UDP=""

## Type:	string
# For VPN/Routing which END at the firewall!!
FW_SERVICES_DMZ_IP=""

## Type:	string
#
# Common: ssh smtp domain
FW_SERVICES_INT_TCP="smtp pop3"

## Type:	string
# Common: domain syslog
FW_SERVICES_INT_UDP=""

# For VPN/Routing which END at the firewall!!
FW_SERVICES_INT_IP=""

## Type:	string
# 9a.)
# External services in QUICKMODE.
# This is only used for QUICKMODE (see 1.)!
# (The settings here are similar to section 9.)
# Which services ON THE FIREWALL should be accessible from either the 
# internet (or other untrusted networks), i.e. the external interface(s)
# $FW_DEV_EXT
#
# Enter all ports or known portnames below, seperated by a space.
# TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_QUICK_TCP, and
# UDP services (e.g. syslog) must be set in FW_SERVICES_QUICK_UDP.
# e.g. if a secure shell daemon on the firewall should be accessible from
# the internet: 
# FW_SERVICES_QUICK_TCP="ssh"
# e.g. if the firewall should receive isakmp (IPsec) internet:
# FW_SERVICES_QUICK_UDP="isakmp"
# For IP protocols (like IPsec) you need to set
# FW_SERVICES_QUICK_IP="50"
#
# Choice: leave empty or any number of ports, known portnames (from
# /etc/services) and port ranges seperated by a space. Port ranges are
# written like this: allow port 1 to 10 -> "1:10"
# e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514"
# For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2")
#
# QUICKMODE: TCP services open to external networks (InterNet)
# (Common: ssh smtp)
FW_SERVICES_QUICK_TCP=""

## Type:	string
# QUICKMODE: UDP services open to external networks (InterNet)
# (Common: isakmp)
FW_SERVICES_QUICK_UDP=""

## Type:	string
# QUICKMODE: IP protocols unconditionally open to external networks (InterNet)
# (For VPN firewall that is VPN gateway: 50)
FW_SERVICES_QUICK_IP=""

## Type:	string
#
# 10.)
# Which services should be accessible from trusted hosts/nets?
#
# Define trusted hosts/networks (doesnt matter if they are internal or
# external) and the TCP and/or UDP services they are allowed to use.
# Please note that a trusted host/net is *not* allowed to ping the firewall
# until you set it to allow also icmp!
#
# Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or
# networks, seperated by a space. e.g. "172.20.1.1 172.20.0.0/16"
# Optional, enter a protocol after a comma, e.g. "1.1.1.1,icmp"
# Optional, enter a port after a protocol, e.g. "2.2.2.2,tcp,22"
#
FW_TRUSTED_NETS=""

## Type:	string
#
# 11.)
# How is access allowed to high (unpriviliged [above 1023]) ports?
#
# You may either allow everyone from anyport access to your highports ("yes"),
# disallow anyone ("no"), anyone who comes from a defined port (portnumber or
# known portname) [note that this is easy to circumvent!], or just your
# defined nameservers ("DNS").
# Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root
# from a firewall using this script (well, you can if you include range
# 600:1023 in FW_SERVICES_EXT_UDP ...).
# Please note that with v2.1 "yes" is not mandatory for active FTP from
# the firewall anymore.
#
# Choice: "yes", "no", "DNS", portnumber or known portname,
#         if not set defaults to "no"
#
# Common: "ftp-data", better is "yes" to be sure that everything else works :-(
FW_ALLOW_INCOMING_HIGHPORTS_TCP="no"

## Type:	string
# Common: "DNS" or "domain ntp", better is "yes" to be sure ...
FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS"

## Type:	yesno
## Default:	yes
#
# 12.)
# Are you running some of the services below?
# They need special attention - otherwise they won´t work!
#
# Set services you are running to "yes", all others to "no",
# if not set defaults to "no"
# If you want to offer the below services to your DMZ as well,
# (and not just internally), set the switches below to "dmz",
# if you even want to offer to the world as well, set to "ext"
# instead of "yes" (NOT RECOMMENDED FOR SECURITY REASONS!)
#
FW_SERVICE_AUTODETECT="yes"
# Autodetect the services below when starting

## Type:	yesno
## Default:	no
# If you are running bind/named set to yes. Remember that you have to open
# port 53 (or "domain") as udp/tcp to allow incoming queries.
# Also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes"
FW_SERVICE_DNS="no"

## Type:	yesno
## Default:	no
# if you use dhclient to get an ip address you have to set this to "yes" !
FW_SERVICE_DHCLIENT="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is a DHCP server
FW_SERVICE_DHCPD="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is running squid. You still have to open the
# tcp port 3128 to allow remote access to the squid proxy service.
FW_SERVICE_SQUID="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is running a samba server. You still have to 
# open the tcp port 139 to allow remote access to SAMBA.
FW_SERVICE_SAMBA="no"

## Type:	string
#
# 13.)
# Which services accessed from the internet should be allowed to the
# dmz (or internal network - if it is not masqueraded)?
# REQUIRES: FW_ROUTE
#
# With this option you may allow access to e.g. your mailserver. The
# machines must have valid, non-private, IP addresses which were assigned to
# you by your ISP. This opens a direct link to your network, so only use
# this option for access to your dmz!!!!
#
# Choice: leave empty (good choice!) or use the following explained syntax
# of forwarding rules, seperated each by a space.
# A forwarding rule consists of 1) source IP/net and 2) destination IP
# seperated by a comma. e.g. "1.1.1.1,2.2.2.2 3.3.3.3/16,4.4.4.4/24"
# Optional is a protocol, seperated by a comma, e.g. "5.5.5.5,6.6.6.6,igmp"
# Optional is a port after the protocol with a comma, e.g. "0/0,0/0,udp,514"
#
# This is for routable address, not internal address!
FW_FORWARD=
#Beware to use this!

## Type:	string
#
# 14.)
# Which services accessed from the internet should be allowed to masqueraded
# servers (on the internal network or dmz)?
# REQUIRES: FW_ROUTE
#
# With this option you may allow access to e.g. your mailserver. The
# machines must be in a masqueraded segment and may not have public IP addesses!
# Hint: if FW_DEV_MASQ is set to the external interface you have to set
# FW_FORWARD from internal to DMZ for the service as well to allow access
# from internal!
#
# Please note that this should *not* be used for security reasons! You are
# opening a hole to your precious internal network. If e.g. the webserver there
# is compromised - your full internal network is compromised!!
#
# Choice: leave empty (good choice!) or use the following explained syntax
# of forward masquerade rules, seperated each by a space.
# A forward masquerade rule consists of 1) source IP/net, 2) the IP to which
# the requests will be forwarded to (in the dmz/intern net), 3) a protocol
# (tcp/udp only!) and 4) destination port, seperated by a comma (","), e.g.
# "4.0.0.0/8,1.1.1.1,tcp,80"
#
# Optional is a port after the destination port, to redirect the request to
# a different destination port on the destination IP, e.g.
# "4.0.0.0/8,1.1.1.1,tcp,80,81"
#
# Optional is an target IP address on which should the masquerading be decided.
# You have to set the optional port option to use this.
#
# Example:
# 200.200.200.0/24,10.0.0.10,tcp,80,81,202.202.202.202
# The class C network 200.200.200.0/24 trying to access 202.202.202.202 port
# 80 will be forwarded to the internal server 10.0.0.10 on port 81.
# Example:
# 200.200.200.0/24,10.0.0.10,tcp,80
# The class C network 200.200.200.0/24 trying to access anything which goes
# through this firewall ill be forwarded to the internal server 10.0.0.10 on
# port 80
#
FW_FORWARD_MASQ="0.0.0.0/0,192.168.0.105,tcp,25 0.0.0.0/0,192.168.0.105,tcp,110"

## Type:	string
#
# 15.)
# Which accesses to services should be redirected to a localport on the
# firewall machine?
#
# This can be used to force all internal users to surf via your squid proxy,
# or transparently redirect incoming webtraffic to a secure webserver.
# 
# Choice: leave empty or use the following explained syntax of redirecting
# rules, seperated by a space.
# A redirecting rule consists of 1) source IP/net, 2) destination IP/net,
# 3) protocol (tcp or udp) 3) original destination port and 4) local port to
# redirect the traffic to, seperated by a colon. e.g.:
# "10.0.0.0/8,0/0,tcp,80,3128 0/0,172.20.1.1,tcp,80,8080"
# Please note that as 2) destination, you may add '!' in front of the IP/net
# to specify everything EXCEPT this IP/net.
#
FW_REDIRECT=""

## Type:	yesno
## Default:	yes
#
# 16.)
# Which logging level should be enforced?
# You can define to log packets which were accepted or denied.
# You can also the set log level, the critical stuff or everything.
# Note that logging *_ALL is only for debugging purpose ...
#
# Choice: "yes" or "no", if not set FW_LOG_*_CRIT defaults to "yes", and
# FW_LOG_*_ALL defaults to "no"
#
FW_LOG_DROP_CRIT="yes"

## Type:	yesno
## Default:	no
#
FW_LOG_DROP_ALL="yes"

## Type:	yesno
## Default:	yes
#
FW_LOG_ACCEPT_CRIT="yes"

## Type:	yesno
## Default:	no
#
FW_LOG_ACCEPT_ALL="no"

## Type:	string
#
# only change/activate this if you know what you are doing!
FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW"

## Type:	yesno
## Default:	yes
#
# 17.)
# Do you want to enable additional kernel TCP/IP security features?
# If set to yes, some obscure kernel options are set.
# (icmp_ignore_bogus_error_responses, icmp_echoreply_rate,
#  icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate,
#  ip_local_port_range, log_martians, mc_forwarding, mc_forwarding,
#  rp_filter, routing flush)
# Tip: Set this to "no" until you have verified that you have got a
# configuration which works for you. Then set this to "yes" and keep it
# if everything still works. (It should!) ;-)
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_KERNEL_SECURITY="yes"

## Type:	yesno
## Default:	no
#
# 18.)
# Keep the routing set on, if the firewall rules are unloaded?
# REQUIRES: FW_ROUTE
#
# If you are using diald, or automatic dialing via ISDN, if packets need
# to be sent to the internet, you need to turn this on. The script will then
# not turn off routing and masquerading when stopped.
# You *might* also need this if you have got a DMZ.
# Please note that this is *insecure*! If you unload the rules, but are still
# connected, you might your internal network open to attacks!
# The better solution is to remove "/sbin/SuSEfirewall2 stop" or
# "/sbin/init.d/firewall stop" from the ip-down script!
#
#
# Choices "yes" or "no", if not set defaults to "no"
#
FW_STOP_KEEP_ROUTING_STATE="no"

## Type:	yesno
## Default:	yes
#
# 19.)
# Allow (or don't) ICMP echo pings on either the firewall or the dmz from
# the internet? The internet option is for allowing the DMZ and the internal
# network to ping the internet.
# REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ and FW_ALLOW_PING_EXT
#
# Choice: "yes" or "no", defaults to "no" if not set
#
FW_ALLOW_PING_FW="yes"

## Type:	yesno
## Default:	no
#
FW_ALLOW_PING_DMZ="no"

## Type:	yesno
## Default:	no
#
FW_ALLOW_PING_EXT="no"

##
# END of /etc/sysconfig/SuSEfirewall2
##

#                                                                         #
#-------------------------------------------------------------------------#
#                                                                         #
# EXPERT OPTIONS - all others please don't change these!                  #
#                                                                         #
#-------------------------------------------------------------------------#
#                                                                         #

## Type:	yesno
## Default:	yes
#
# 20.)
# Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall.
# This is used for traceroutes to your firewall (or traceroute like tools).
#
# Please note that the unix traceroute only works if you say "yes" to
# FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say
# additionally "yes" to FW_ALLOW_PING_FW
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_FW_TRACEROUTE="yes"

## Type:	yesno
## Default:	yes
#
# 21.)
# Allow ICMP sourcequench from your ISP?
#
# If set to yes, the firewall will notice when connection is choking, however
# this opens yourself to a denial of service attack. Choose your poison.
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_ALLOW_FW_SOURCEQUENCH="yes"

## Type:	yesno
## Default:	no
#
# 22.)
# Allow/Ignore IP Broadcasts?
#
# If set to yes, the firewall will not filter broadcasts by default.
# This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast
# option is used.
# If you do not want to allow them however ignore the annoying log entries,
# set FW_IGNORE_FW_BROADCAST to yes.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_FW_BROADCAST="no"

## Type:	yesno
## Default:	yes
#
FW_IGNORE_FW_BROADCAST="yes"

## Type:	yesno
## Default:	no
#
# 23.)
# Allow same class routing per default?
# REQUIRES: FW_ROUTE
#
# Do you want to allow routing between interfaces of the same class
# (e.g. between all internet interfaces, or all internal network interfaces)
# be default (so without the need setting up FW_FORWARD definitions)?
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_CLASS_ROUTING="no"

## Type:	string
#
# 25.)
# Do you want to load customary rules from a file?
#
# This is really an expert option. NO HELP WILL BE GIVEN FOR THIS!
# READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom
#
#FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
FW_CUSTOMRULES=""

## Type:	yesno
## Default:	no
#
# 26.)
# Do you want to REJECT packets instead of DROPing?
#
# DROPing (which is the default) will make portscans and attacks much
# slower, as no replies to the packets will be sent. REJECTing means, that
# for every illegal packet, a connection reject packet is sent to the
# sender.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_REJECT="no"

## Type:	string
#
# 27.)
# Tuning your upstream a little bit via HTB (Hierarchical Token Bucket)
# for more information about HTB see http://www.lartc.org
#
# If your download collapses while you have a parallel upload,
# this parameter might be an option for you. It manages your
# upload stream and reserves bandwidth for special packets like
# TCP ACK packets or interactive SSH.
# It's a list of devices and maximum bandwidth in kbit.
# For example, the german TDSL account, provides 128kbit/s upstream
# and 768kbit/s downstream. We can only tune the upstream.
#
# Example:
# If you want to tune a 128kbit/s upstream DSL device like german TDSL set
# the following values:
# FW_HTB_TUNE_DEV="ppp0,125"
# where ppp0 is your pppoe device and 125 stands for 125kbit/s upstream
#
# you might wonder why 125kbit/s and not 128kbit/s. Well practically you'll
# get a better performance if you keep the value a few percent under your
# real maximum upload bandwidth, to prevent the DSL modem from queuing traffic in
# it's own buffers because queing is done by us now.
# So for a 256kbit upstream
#   FW_HTB_TUNE_DEV="ppp0,250"
# might be a better value than "ppp0,256". There is no perfect value for a
# special kind of modem. The perfect value depends on what kind of traffic you
# have on your line but 5% under your maximum upstream might be a good start.
# Everthing else is special fine tuning.
# If you want to know more about the technical background,
# http://tldp.org/HOWTO/ADSL-Bandwidth-Management-HOWTO/
# is a good start
#
FW_HTB_TUNE_DEV=""

bastard23 · 08-12-2004, 03:47 PM

FW_MASQ_DEV="no"
FW_MASQ_NETS=""
These seem wrong. I would guess $FW_DEV_EXT and 192.168.0.0/24 respectively.

You gateway isn't running the public mail server is it? Get rid of smtp pop3 25 110 from FW_SERVICES*

derrickhackman · 08-12-2004, 04:23 PM

Thank you, it is getting closer. In /var/log/messages i can see the packets getting accepted from the mail relay server, and it looks like the DST is correct ( i see this log detail when i send mail from my machine, i am tailing the log on the server running the FW). In the below log, i x-ed out the public IP addrs, my company probably would like it this way.

Code:

Aug 12 17:22:46 folsom kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT= MAC=00:b0:d0:49:99:62:00:e0:97:10:06:b4:08:00 SRC=xx.xx.xx.xx DST=xx.xx.xx.xxLEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=50389 DF PROTO=TCP SPT=33968 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01ED63CF0000000001030300)
Aug 12 17:22:49 folsom kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT= MAC=00:b0:d0:49:99:62:00:e0:97:10:06:b4:08:00 SRC=xx.xx.xx.xxDST=xx.xx.xx.xx LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=50391 DF PROTO=TCP SPT=33968 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01ED6F870000000001030300)
Aug 12 17:22:55 folsom kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT= MAC=00:b0:d0:49:99:62:00:e0:97:10:06:b4:08:00 SRC=xx.xx.xx.xxDST=xx.xx.xx.xx LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=50394 DF PROTO=TCP SPT=33968 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01ED86F70000000001030300)

BUT, when i try to telnet to port 25 on the FW server, the packets get dropped. perhaps i have it configured this way, not sure...

Code:

Aug 12 17:12:41 folsom kernel: SuSE-FW-ACCEPT-REVERSE_MASQ IN=eth0 OUT=eth1 SRC=xx.xx.xx.xx DST=192.168.0.105 LEN=64 TOS=0x00 PREC=0x00 TTL=51 ID=44508 DF PROTO=TCP SPT=41922 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 OPT (010303010101080A4FC9585B0000000001010402020405B4)
Aug 12 17:12:41 folsom kernel: SuSE-FW-ACCEPT-REVERSE_MASQ IN=eth0 OUT=eth1 SRC=xx.xx.xx.xx DST=192.168.0.105 LEN=64 TOS=0x00 PREC=0x00 TTL=50 ID=44507 DF PROTO=TCP SPT=41921 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 OPT (010303010101080A4FC9585B0000000001010402020405B4)

shouldn't i be able to telnet to this port? internally on a ( 192.168.0.0/24 ) i can telnet to the port of the internal mail server. however cannot telnet using the FW IP addr.

Getting close... i will have to buy you a beer and send it off air mail once this gets 'kicked' :-)

bastard23 · 08-12-2004, 05:22 PM

The first log show a connection to the telnet port (23) and it looks like it is being dropped. This is correct, so to test smtp make sure to do telnet mailhost 25.

The second one looks like the smtp (25) is getting through. Is qmail not seeing this? Are you testing this from inside or outside your network. It probably isn't forwarding/masq inside to inside.

Good Luck,
chris

derrickhackman · 08-12-2004, 05:40 PM

Here is the log for port 25, must have fat-fingered the other test...

Code:

Aug 12 18:46:12 folsom kernel: SuSE-FW-ACCEPT-REVERSE_MASQ IN=eth0 OUT=eth1 SRC=xx.xx.xx.xx DST=192.168.0.105 LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=53696 DF PROTO=TCP SPT=34346 DPT=25 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A0239C7B00000000001030300)

it does look like it is getting through.

Qmail isnt seeing the activity because internal MASQ probably is not set up correctly. Dont I have to set this up on the FW server? From what i understand i have the FW handle the forwarding, the QMail server sits and listens for requests. Do i need another MASQ setting other than
FW_FORWARD_MASQ="0.0.0.0/0,192.168.0.105,tcp,25 0.0.0.0/0,192.168.0.105,tcp,110" ?

It appears to be getting through the FW, but doesnt get to the QMail server.

bastard23 · 08-12-2004, 06:34 PM

Try grepping for 192.168.0.105 on you kernel logs to see if it is dropped anywhere else

Run "tcpdump -i eth1 port 25" to see it go out on the wire. Use tcpdump on the mail server to see if it is getting there.

Otherwise post:
iptables -L | grep 192.168.0.105
and
iptables -L -t nat | grep 192.168.0.105
So we can see if the rules are getting setup alright.

I think that the FW_FORWARD_MASQ should be setting up your port-forwarding for you. (I think that's what you mean by "Qmail isnt seeing the activity because internal MASQ probably is not set up correctly.")

Unfortunately I don't use the SuSEFirewall2 stuff. Seemed like an extra headache when I already knew what I wanted to do. But I have used it and other scripts as a reference for doing some of the more complicated things and I usually don't do all the logging. YMMV.

derrickhackman · 08-12-2004, 06:42 PM

something that is odd is on the QMail server i can telnet localhost 25 and get a connection. From the FW machine when i access the QMail server with telnet (telnet 192.168.0.105 25 ) i get a connection refused error. There is no FW running on the QMail server. I am going to try what you suggested in your last post and let you know how i am making out. Again, thank you for all your help Chris.
-derrick

bastard23 · 08-12-2004, 08:16 PM

Run a "netstat -lp" (list listening sockets, program names) on your mail server. qmail-smtpd (or there abouts) isn't listening to the 192.168.0.105 address. I tend to forget about qmail as soon as I step away from it, so I don't know what you need to modify to get this.

Good Luck,
chris

derrickhackman · 08-13-2004, 05:05 AM

Just a refresher:
( Internet ) ---> [eth0] { FW SERVER } [eth1] ---> 192.168.0.105 { qmail server )

When i run netstat -lp on the QMail server, i get the following:

Code:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:mysql                 *:*                     LISTEN      757/mysqld-max
tcp        0      0 *:netbios-ssn           *:*                     LISTEN      929/smbd
tcp        0      0 *:pop3                  *:*                     LISTEN      972/tcpserver
tcp        0      0 *:sunrpc                *:*                     LISTEN      604/portmap
tcp        0      0 localhost:smtp          *:*                     LISTEN      669/master
tcp        0      0 *:www-http              *:*                     LISTEN      7062/httpd
tcp        0      0 *:ssh                   *:*                     LISTEN      740/sshd
udp        0      0 RIKERS.local:netbios-ns *:*                                 627/nmbd
udp        0      0 *:netbios-ns            *:*                                 627/nmbd
udp        0      0 RIKERS.loca:netbios-dgm *:*                                 627/nmbd
udp        0      0 *:netbios-dgm           *:*                                 627/nmbd
udp        0      0 *:sunrpc                *:*                                 604/portmap
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     1815   669/master          public/cleanup
unix  2      [ ACC ]     STREAM     LISTENING     2099   669/master          private/rewrite
unix  2      [ ACC ]     STREAM     LISTENING     2103   669/master          private/bounce
unix  2      [ ACC ]     STREAM     LISTENING     2107   669/master          private/defer
unix  2      [ ACC ]     STREAM     LISTENING     2111   669/master          public/flush
unix  2      [ ACC ]     STREAM     LISTENING     2115   669/master          private/proxymap
unix  2      [ ACC ]     STREAM     LISTENING     2119   669/master          private/smtp
unix  2      [ ACC ]     STREAM     LISTENING     2952   757/mysqld-max      /var/lib/mysql/mysql.sock
unix  2      [ ACC ]     STREAM     LISTENING     2123   669/master          private/relay
unix  2      [ ACC ]     STREAM     LISTENING     2127   669/master          public/showq
unix  2      [ ACC ]     STREAM     LISTENING     2131   669/master          private/error
unix  2      [ ACC ]     STREAM     LISTENING     2135   669/master          private/local
unix  2      [ ACC ]     STREAM     LISTENING     2139   669/master          private/virtual
unix  2      [ ACC ]     STREAM     LISTENING     2143   669/master          private/lmtp
unix  2      [ ACC ]     STREAM     LISTENING     2147   669/master          private/maildrop
unix  2      [ ACC ]     STREAM     LISTENING     2151   669/master          private/cyrus
unix  2      [ ACC ]     STREAM     LISTENING     2155   669/master          private/uucp
unix  2      [ ACC ]     STREAM     LISTENING     2159   669/master          private/ifmail
unix  2      [ ACC ]     STREAM     LISTENING     2163   669/master          private/bsmtp
unix  2      [ ACC ]     STREAM     LISTENING     2167   669/master          private/vscan
unix  2      [ ACC ]     STREAM     LISTENING     2171   669/master          private/procmail
unix  2      [ ACC ]     STREAM     LISTENING     3114   766/acpid           /var/run/acpid.socket
unix  2      [ ACC ]     STREAM     LISTENING     2649   722/nscd            /var/run/.nscd_socket

Also when i run tcpdump on eth0 right after i send a mail message externally, meaning it is hitting the FW on eth0, i get the following:

Code:

01:59:46.998032 mail1.wss.vip.scd.yahoo.com.smtp > 67.109.108.212.ptr.us.xo.net.konshus-lm: F 353:353(0) ack 89 win 33304 <nop,nop,timestamp 3998211415 83073120> (DF)
01:59:46.998115 67.109.108.212.ptr.us.xo.net.konshus-lm > mail1.wss.vip.scd.yahoo.com.smtp: . ack 354 win 6432 <nop,nop,timestamp 83073215 3998211415> (DF)

When i try telnet port 25 on eth0 i get this in the tcpdump log:

Code:

02:02:05.097695 alb-24-194-85-185.nycap.rr.com.34868 > alcatraz.customerportfolios.com.smtp: S 3475529123:3475529123(0) win 5840 <mss 1460,sackOK,timestamp 78418674 0,nop,wscale 0> (DF)
02:02:05.098369 alcatraz.customerportfolios.com.smtp > alb-24-194-85-185.nycap.rr.com.34868: R 0:0(0) ack 3475529124 win 0 (DF)

now for action on eth1 which talks to the internal network...

when i tenlet to the eth0 externally on port 25 i see this while doing a tcpdump on eth1 (internal interface):

Code:

02:05:04.122284 alb-24-194-85-185.nycap.rr.com.34870 > 192.168.0.105.smtp: S 3685750744:3685750744(0) win 5840 <mss 1460,sackOK,timestamp 78597716 0,nop,wscale 0> (DF)
02:05:04.122519 192.168.0.105.smtp > alb-24-194-85-185.nycap.rr.com.34870: R 0:0(0) ack 3685750745 win 0 (DF)

and when i send mail (externally), i do not see any activity on eth1 of the FW.

and finally, if i try to telnet 192.168.0.105 25 while on the FW, i get connection refused.

thoughts?

bastard23 · 08-13-2004, 11:31 AM

derrick,

Well, first the good news. Your firewall is port forwarding the smtp connection. All the tcpdumps show a SYN, then a response of RST,ACK which means Open a port and connection refused respectively.

We are now looking at setting up your mailer. So feel free to start a new thread if you have problems with it. My qmail knowlegde was never that great.

The bad news is you mail server is not listening for remote connections:
tcp 0 0 localhost:smtp *:* LISTEN 669/master

The other problem is that you've said that qmail is running. This appears to be postifx, not qmail, listening on your smtp port.

IF you want qmail to run you need to stop postfix, uninstall it and get qmail to run. That's not something I know off the top of my head

# Stop
postfix stop
# Rerun the necessary qmail bits here.
# I don't remember exactly what needs to be run, so to jog your memory
# tcpserve
# qmail-smtpd
# svc

ELSE if you want postfix (personally I prefer it over qmail) then this is what you need to do to get it to listen on the proper ports:

# This configures postfix to listen on all interfaces, not just the loopback
# You can also use the hostname or ip address you want it to listen to.
postconf -e "inet_interfaces = all"
# Postfix needs to be restarted for this change as it affects the master process.
postfix stop
postfix start

derrickhackman · 08-13-2004, 11:38 AM

i have been throught the qmail docs and at the completion of the install, it stated it was installed correctly, based on the scripts you run post install. i will look at this everything you mentioned again and see if i can figure this out. you did manage to help me out with getting the port open on the FW, for that i thank you (and will send you a beer).

as for QMail i will dig into this as the source of my problem.

best and thank you again.
-derrick

bastard23 · 08-13-2004, 09:05 PM

derrick,

Just make sure to uninstall postfix. It will only get in the way and cause weird problems, if you are use another MTA.

Have fun,
chris