Vijay - port 25 to be blocked

Vijay - port 25 to be blocked

[Vijay Kumar]

Hi,

I want to allow my internal network to only connect to some specific email
servers.
Apart from these mail server  I want to block port 25 and 110 from my
internal network to anywhwere. I am doing the following : 

iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
REJECT  
 
This does not seem to block the port 25 traffic. Where am I going wrong? 

Kindly help. 

Regards,
Vijay Kumar

 

Re: Vijay - port 25 to be blocked

[Javier Sanchez]

You are using INPUT, and should be using the OUTPUT chain because you
need to filter traffic comming from an external network. You can also
put the filter on the INPTU chain, in this case you shuld use --sport
instead of --dport.


So it should be:

To filter incoming traffic from a forbidden mail server.

iptables -I INPUT -i eth0 --sport 25 -d  !<ip addr of mail server>  -j
REJECT

To filter outgoing traffic to a forbidden mail server.

iptables -I OUTPUT -o eth0 --dport 25 -d  !<ip addr of mail server>  -j
REJECT

You should use the second option, but depend on your firewall ruleset
implementation, any of them will do the trick .-)

Cheers

El mar, 28-12-2004 a las 21:52 +0530, Vijay Kumar escribió:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following : 
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT  
>  
> This does not seem to block the port 25 traffic. Where am I going wrong? 
> 
> Kindly help. 
> 
> Regards,
> Vijay Kumar
> 
>  
> 
> 
> 

Re: Vijay - port 25 to be blocked

[Eric Ellis]

Vijay Kumar wrote:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following : 
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT  
>  
> This does not seem to block the port 25 traffic. Where am I going wrong? 
> 
> Kindly help. 
> 
> Regards,
> Vijay Kumar
> 
>  
> 
Lemme try this again,

I believe that this needs to be in the "forward" table, not the "input" 
table.

IIRC, Input is just for traffic destined to the firewall box itself, the 
mail servers that you're talking to are on the far side of the firewall, 
if I read you correctly.

Re: Vijay - port 25 to be blocked

[Askar]

try this ,
#iptables -A FORWARD -i eth0 -o ppp0 --dport 25 -d  !<ip addr of mail
server>  -j
DROP

don't forget to replace -i eth0 with your LAN inteface and -o ppp0
with your external interface




On Tue, 28 Dec 2004 21:52:46 +0530, Vijay Kumar <vijay@calsoftinc.com> wrote:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following :
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT
> 
> This does not seem to block the port 25 traffic. Where am I going wrong?
> 
> Kindly help.
> 
> Regards,
> Vijay Kumar
> 
>  
> 
> 


-- 
(after bouncing head on desk for days trying to get mine working, I'll make
your life a little easier)

Re: Vijay - port 25 to be blocked

[ASHISH]

Infact the rule that you have written makes no sense as any packet in
input chain with dport as 25 is meant for your machine's SMTP server.
So if your rule is translated in plain english, it would loook like

"Deny access to all IP addresses other than <ip addr of mail server>
to the mail server running on my machine".

If you are writing this rule to your gateway, just write in it's
FORWARD chain. If you are writing this rule for you company's SMTP
server (if all mail in calsoft is  forwarded to  smtp.calsoftinc.com
and this server in turn forwards it to respective mail servers on net)
then put it in that machine's output chain.


On Tue, 28 Dec 2004 21:52:46 +0530, Vijay Kumar <vijay@calsoftinc.com> wrote:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following :
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT
> 
> This does not seem to block the port 25 traffic. Where am I going wrong?
> 
> Kindly help.
> 
> Regards,
> Vijay Kumar
> 


-- 
cheers
Ashish
KReSIT
IIT Bombay