Hello,
My server is on Mandriva 10.1
eth0 is WAN with static IP connected to 512K DSL
eth1 is LAN - 192.168.0.0/24 and 192.168.21.0/24

My rules for the above mentioned server are as follows :

# Generated by iptables-save v1.2.9 on Fri Jan 7 20:56:35 2000
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Jan 7 20:56:35 2000
# Generated by iptables-save v1.2.9 on Fri Jan 7 20:56:35 2000
*mangle
:PREROUTING ACCEPT [1024:195745]
:INPUT ACCEPT [1019:194076]
:FORWARD ACCEPT [2:144]
:OUTPUT ACCEPT [1000:192114]
:POSTROUTING ACCEPT [999:192086]
COMMIT
# Completed on Fri Jan 7 20:56:35 2000
# Generated by iptables-save v1.2.9 on Fri Jan 7 20:56:35 2000
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth1 --dport 3128 --sport 1024:65535 -j ACCEPT
-A INPUT -p udp -m udp -i eth1 --dport 3128 --sport 1024:65535 -j ACCEPT
-A INPUT -s 62.0.0.0/255.0.0.0 -i eth0 -j REJECT
-A INPUT -p tcp -m tcp -s 217.81.0.0/255.255.0.0 -i eth0 -j REJECT
-A INPUT -i eth0 -j DROP
-A INPUT -p tcp -m tcp -i eth1 --sport 80 -j DROP
-A INPUT -m state -i eth1 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p tcp -i eth1 -o eth0 --dport 25 --sport 1024: -j ACCEPT --syn
-A FORWARD -p tcp -i eth1 -o eth0 --dport 110 --sport 1024: -j ACCEPT --syn
-A FORWARD -p tcp -i eth1 -o eth0 --dport 1863 --sport 1024: -j ACCEPT --syn
-A FORWARD -p tcp -i eth1 -o eth0 --dport 5050 --sport 1024: -j ACCEPT --syn
-A OUTPUT -p udp --dport 53 --sport 1024: -j ACCEPT
COMMIT
# Completed on Fri Jan 7 20:56:35 2000


Clients can browse after making proxy settings.
That part seems to work OK.

But clients are not able to sebd / recieve mails.

When I open thinderbird on a client I get a message :

" connecting to mail.vsnl.net "

After a while I get a request timed out message box .
So why are the mails not coming thru' ?

Please feel free to comment .

Thanks in advance

Varun

A good diagnostic is to type in a terminal and try sending an email. The rules that are being used will have their counters highlighted.

Can you ping the mailserver - could be a dns problem. To test this, ping by name then IP address. If the ping by IP address (203.200.235.182) works, but not by name this is your problem.

You can also try You are allowing all forwarding, so the forward lines (though they should work ok) are superfluous here - is this because you have set the forward policy to accept for testing and will reset it to drop when you have finished?


Chris

telnet mail.vsnl.net 110
gives no response.

I shall put a DROP policy at end of FORWARD rules.
Is that OK.

Varun

watch -d iptables -nvL -> gives the following


Every 2.0s: iptables -nvL Mon May 9 11:36:33 2005

Chain INPUT (policy ACCEPT 25339 packets, 3067K bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 289 packets, 20494 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 7895 packets, 1313K bytes)
pkts bytes target prot opt in out source destination

Thanks for teaching me some tips

Varun

The output of iptables says you are accepting everything...


I still suspect a DNS problem - try the ping tests. What are your clients using as a nameserver?

The web browsing would still work because the squid server is dong the DNS look ups.


Chris