iptables port forwarding

jefmwols · 05-19-2005, 11:41 PM

I have read through the other threads pertaining to ip tables and port forwarding, but I have not been able to figure out what I need to do. I also read the thread about using iptables to forward port 25 internally for send mail purposes, but I don't know enough to be able to follow it.

Some threads say to add some code, but I don't even know to what files I would add such code.

My isp blocks port 25 to prevent spamming. Unfortunately, enough spamming occurs from my isps SMTP that mail servers such as yahoo block it as a possible open relay. I need to use an arbitrary port to get my mail to my server and then route that port to port 25 on my server so that sendmail can send my mail.

I would like to accomplish this using iptables, but I don't know where to start.

If it is possible to make sendmail listen on a different port without recompiling it, I suppose that would be a viable alternative to my problem.

Thanks

fr_laz · 05-20-2005, 04:01 AM

Hi,

what you're speaking of is called port redirection.
this is done like this (say you use port 1389 to get your mail to your server) :
iptables -t nat -A PREROUTING -d $PUBLIC_IP --p tcp --dport 1389 --to-destination $PRIVATE_IP:25

which means :
In the NAT table (Network address translation),
every packet going to your public IP (the one your ISP gave you) using protocol TCP and aiming at port 1389
is to be translated so that its destination's IP is changed to $PRIVATE_IP and the destination port 25.

Is this what you were after ? If not, then re-explain your problem

jefmwols · 05-20-2005, 10:42 AM

That may be what I need, except that I do not have a NAT network. The only ip's on my server are public ones, 8 public ips on 1 NIC. I guess that means I need to use a table other than nat.

I need to redirect this port to port 25 on the same machine.

When I type this at the command prompt putting my ip in place of your ip variables, I get the message

Quote:

unknown arg '--to-destination'

Any ideas?

Thanks

fuzzyash · 05-20-2005, 12:19 PM

To start with, the port that sendmail listens on can be changed by editing the file /etc/mail/sendmail.cf Find the line that looks something like this:

O DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA

(in my file it was on line 265) & change "Port=smtp" to any port you want. For example, to use port 2020, change to:

O DaemonPortOptions=Port=2020,Addr=127.0.0.1, Name=MTA

Even if this works, I would like to try & help you to implement port forwarding because I am curious as to what is going on with your setup, also because sendmail sucks! I would urge you to forget about sendmail & use qmail. Sendmail has many security holes, is difficult to configure, doesn't do things easily, etc. Qmail on the other hand is the most secure mail delivery system there is, it's far easier to configure, does everything you'll ever need & more, but most of all, http://www.qmailrocks.org/ will make you an expert in no time.

Anyway, back to the NAT problem...
The NAT table should suit your needs but you need a bit more config than just 1 line.
First, we'll need some more info about your setup:

What are the 8 public IP's on your NIC for? & why havent you got any internal, private IP's?
You call the computer you are trying to achieve this on your "server", I take it this means that you have at least 1 other PC that you are trying send mail from to your server & then forward that mail to whomever it is addressed to. Is this correct?
How is the PC you are trying to send mail from connected to your server?
You say, "I need to use an arbitrary port to get my mail to my server and then route that port to port 25 on my server so that sendmail can send my mail" This sounds strange. If you are connecting to your server via a LAN, then you should have no problems connecting to port 25 on your server, & if your ISP is blocking port 25 then even if you do use an arbitrary port to get your mail to your server & then route that port to port 25, you won't be able to send the mail because it will be blocked by your ISP. Perhaps you have this backwards?
You say your ISP blocks port 25, does this mean that your ISP does not give you an email account & thats why your trying to setup your own SMTP server?

One last thing, at a command prompt, type:

/sbin/iptables -L; /sbin/iptables -t nat -L; /sbin/iptables -t mangle -L

& post results. This is important & will help a lot. It will display your firewall config & might show up an error.

jefmwols · 05-20-2005, 01:49 PM

I was able to change the port that sendmail listens to. Unfortunately, this stops sendmail from listening on port 25 which causes my alias-forwarding to stop working. Perhaps sendmail can listen on 2 port simultaneousley?

I would like to switch to qmail, but sendmail is tied-in to my ensim control panel which my hosting customers use. I suppose I could leave sendmail on port 25 and add qmail just for the purpose of listening for me on some other port.

Here's the output you ask for:

Code:

[root@ensim root]# /sbin/iptables -L; /sbin/iptables -t nat -L; /sbin/iptables -t mangle -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
[root@ensim root]#

My server is a few hundred miles away, so I connect to it using the internet. I host several domains on this server including some from which I send email. My isp blocks port 25 forcing its customers to use the isp smtp server. This is an anti-spam attempt by the isp. Unfortunately, their smtp server has many problems which sometimes keep me from sending mail to my customers. This is why I want to use MY smtp server on my web-server.

I suppose that my web-server may not even have a NAT table since all of its ips are public. The miltiple ips are so that I can have multiple domains with ssl certs.

Does this clear things up at all?

eantoranz · 05-20-2005, 03:46 PM

I think I don't undertsnad very well. Is it what you mean?

You want to bea ble to use your SMTP server which is reachable through internet... but yo9u can't use port 25 from your client (throught internet) cause the ISP will block port 25 requests to your server... yet port 25 is where your server is waiting for requests?

In that case I think you can use port forward. Let's suppose that your server will listen to SMTP connections through port 1000, and it will forward them to port 25... so that it looks like the smtp service is at port 1000... when it's actually in port 25.

Code:

iptables -t nat -A PREROUTING -d myip -p tcp --dport 1000 -j  REDIRECT --to-port 25

Repeat that for udp.

I guess that would do.

jefmwols · 05-20-2005, 04:29 PM

That's perfect! Thanks so much.

Is there a way to put this into a file so that is will be in effect when I restart my machine?

What is a good way to learn about how to use all of the basic features of iptables?

eantoranz · 05-20-2005, 04:58 PM

in a red-hat based distribution, rc.local is the place.

eantoranz · 05-20-2005, 05:03 PM

About learning iptables.... I personally learned a lot without breaking my head reading Oskar Andreasson's tutorial:
http://iptables-tutorial.frozentux.net/

And find the standard stuff at www.netfilter.org.

jefmwols · 05-20-2005, 05:08 PM

Thanks for you help and patience.