From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Hudin" Subject: Outgoing SMTP Mystery Date: Tue, 4 Jun 2002 15:18:46 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <013601c20c15$cba57520$52cfd3cf@michael> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0133_01C20BDB.1F141B70" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_0133_01C20BDB.1F141B70 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Okay, so I've gotten everything running fine in my tables as far as = HTTP, SSH and POP go, but I'm having a problem with SMTP (I have a qmail = server). I can send SMTP out just fine, but no other server can send it = in for some reason. It would appear in the logs that it is forwarding = fine, but it is still not allowing connections on port 25. My setup is = Public Interface: eth0 - 10.10.10.254 Private Interface eth1 - = 192.168.77.1 My firewall also serves as a gateway for the private LAN = and a VPN server running FreeSWAN. The MX records are set up to point = at 10.10.10.252 as the mail server and as you can see below, that is = indeed forwarding (or at least it should be). I've always assumed that = the numbers in the brackets were port allowances and that may be my = problem, but if they were, I wouldn't be able to get to SSH and HTTP. = Also, if anyone has any security suggestions, since I just cobbled this = together to get it working, they wouldn't fall on deaf ears. Here are my tables: *nat :PREROUTING ACCEPT [241:88600] :POSTROUTING ACCEPT [0:9862] :OUTPUT ACCEPT [68:4275] -A PREROUTING -d 10.10.10.252 -p tcp -m tcp --dport 110 -j DNAT = --to-destination 192.168.77.2 -A PREROUTING -d 10.10.10.252 -p tcp -m tcp --dport 25 -j DNAT = --to-destination 192.168.77.2 -A PREROUTING -d 10.10.10.251 -p tcp -m tcp --dport 80 -j DNAT = --to-destination 192.168.77.2 -A PREROUTING -d 10.10.10.250 -p tcp -m tcp --dport 80 -j DNAT = --to-destination 192.168.77.2 -A PREROUTING -d 10.10.10.250 -p tcp -m tcp --dport 22 -j DNAT = --to-destination 192.168.77.2 -A POSTROUTING -o eth0 -j SNAT --to-source 10.10.10.254 -A POSTROUTING -o eth1 -j SNAT --to-source 10.10.10.254 COMMIT *mangle :PREROUTING ACCEPT [18365:3221456] :INPUT ACCEPT [10886:760348] :FORWARD ACCEPT [7269:2438049] :OUTPUT ACCEPT [8009:752540] :POSTROUTING ACCEPT [15177:3182145] COMMIT *filter :INPUT ACCEPT [0:229546] :FORWARD ACCEPT [363:1553786] :OUTPUT ACCEPT [2:619341] -A INPUT -p udp -m udp --sport 500 --dport 500 -j ACCEPT -A INPUT -p tcp -j ACCEPT -A INPUT -p esp -j ACCEPT -A INPUT -p ah -j ACCEPT -A INPUT -i lo -j ACCEPT -A FORWARD -i eth1 -j ACCEPT -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 110 -m state --state = NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 25 -m state --state = NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 80 -m state --state = NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 22 -m state --state = NEW,RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -p udp -m udp --sport 500 --dport 500 -j ACCEPT -A OUTPUT -p tcp -j ACCEPT -A OUTPUT -p esp -j ACCEPT -A OUTPUT -p ah -j ACCEPT -A OUTPUT -o lo -j ACCEPT COMMIT Michael Hudin Sentinel Systems Support www.zoetrope.com ------=_NextPart_000_0133_01C20BDB.1F141B70 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Okay, so I've gotten everything running = fine in my=20 tables as far as HTTP, SSH and POP go, but I'm having a problem with = SMTP (I=20 have a qmail server).  I can send SMTP out just fine, but no other = server=20 can send it in for some reason.  It would appear in the logs that = it is=20 forwarding fine, but it is still not allowing connections on port = 25.  My=20 setup is Public Interface: eth0 - 10.10.10.254 Private Interface eth1 -=20 192.168.77.1  My firewall also serves as a gateway for the private = LAN and=20 a VPN server running FreeSWAN.  The MX records are set up to point = at=20 10.10.10.252 as the mail server and as you can see below, that is indeed = forwarding (or at least it should be).  I've always assumed that = the=20 numbers in the brackets were port allowances and that may be my problem, = but=20 if they were, I wouldn't be able to get to SSH and HTTP. Also, = if=20 anyone has any security suggestions, since I just cobbled this together = to get=20 it working, they wouldn't fall on deaf ears.
 
Here are my tables:
 
*nat
:PREROUTING ACCEPT=20 [241:88600]
:POSTROUTING ACCEPT [0:9862]
:OUTPUT ACCEPT = [68:4275]
-A=20 PREROUTING -d 10.10.10.252 -p tcp -m tcp --dport 110 -j DNAT = --to-destination=20 192.168.77.2
-A PREROUTING -d 10.10.10.252 -p tcp -m tcp --dport 25 = -j DNAT=20 --to-destination 192.168.77.2
-A PREROUTING -d 10.10.10.251 -p tcp -m = tcp=20 --dport 80 -j DNAT --to-destination 192.168.77.2
-A PREROUTING -d=20 10.10.10.250 -p tcp -m tcp --dport 80 -j DNAT --to-destination=20 192.168.77.2
-A PREROUTING -d 10.10.10.250 -p tcp -m tcp --dport 22 = -j DNAT=20 --to-destination 192.168.77.2
-A POSTROUTING -o eth0 -j SNAT = --to-source=20 10.10.10.254
-A POSTROUTING -o eth1 -j SNAT --to-source=20 10.10.10.254
COMMIT
 
*mangle
:PREROUTING ACCEPT=20 [18365:3221456]
:INPUT ACCEPT [10886:760348]
:FORWARD ACCEPT=20 [7269:2438049]
:OUTPUT ACCEPT [8009:752540]
:POSTROUTING ACCEPT=20 [15177:3182145]
COMMIT
 
*filter
:INPUT ACCEPT = [0:229546]
:FORWARD=20 ACCEPT [363:1553786]
:OUTPUT ACCEPT [2:619341]
-A INPUT -p udp -m = udp=20 --sport 500 --dport 500 -j ACCEPT
-A INPUT -p tcp -j ACCEPT
-A = INPUT -p=20 esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
-A INPUT -i lo -j = ACCEPT
-A=20 FORWARD -i eth1 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -p tcp -m tcp = --dport=20 110 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i = eth0 -o=20 eth1 -p tcp -m tcp --dport 25 -m state --state NEW,RELATED,ESTABLISHED = -j=20 ACCEPT
-A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 80 -m state = --state=20 NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -p tcp = -m tcp=20 --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A = OUTPUT -p=20 udp -m udp --sport 500 --dport 500 -j ACCEPT
-A OUTPUT -p tcp -j = ACCEPT
-A=20 OUTPUT -p esp -j ACCEPT
-A OUTPUT -p ah -j ACCEPT
-A OUTPUT -o lo = -j=20 ACCEPT
COMMIT
 
 
 
 
Michael Hudin
Sentinel Systems = Support
www.zoetrope.com
= ------=_NextPart_000_0133_01C20BDB.1F141B70-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Outgoing SMTP Mystery Date: Tue, 4 Jun 2002 23:37:22 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206042237.g54MbOA10863@Networker.rockstone.co.uk> References: <013601c20c15$cba57520$52cfd3cf@michael> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <013601c20c15$cba57520$52cfd3cf@michael> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Tuesday 04 June 2002 11:18 pm, Michael Hudin wrote: > I can send SMTP out just fine, but no other server can send it in for some > reason. > -A POSTROUTING -o eth0 -j SNAT --to-source 10.10.10.254 > -A POSTROUTING -o eth1 -j SNAT --to-source 10.10.10.254 I really don't like the look of those two rules together. You're saying that any packet going out of the external interface should bear the source address of the external interface - pretty standard. But you're also saying that any packet going out of the *internal* interface should also have the source address of the external interface - why ??? Do you have any access control rules on your SMTP server - is it fussy about the IP addresses it accepts connections from ? What happens if you telnet to port 25 on the mail server from your firewall ? Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Travis Crook" Subject: Re: Outgoing SMTP Mystery Date: Tue, 4 Jun 2002 16:59:22 -0600 Sender: netfilter-admin@lists.samba.org Message-ID: <000001c20c1c$29976340$6702a8c0@mindtrip.com> References: <013601c20c15$cba57520$52cfd3cf@michael> <200206042237.g54MbOA10863@Networker.rockstone.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org My bad. I will fix the rule so that anything going out the internal interface will have the ip of the internal interface! Thanks for pointing that out. Travis Crook Visions Beyond ----- Original Message ----- From: "Antony Stone" To: Sent: Tuesday, June 04, 2002 4:37 PM Subject: Re: Outgoing SMTP Mystery > On Tuesday 04 June 2002 11:18 pm, Michael Hudin wrote: > > > I can send SMTP out just fine, but no other server can send it in for some > > reason. > > > -A POSTROUTING -o eth0 -j SNAT --to-source 10.10.10.254 > > -A POSTROUTING -o eth1 -j SNAT --to-source 10.10.10.254 > > I really don't like the look of those two rules together. You're saying > that any packet going out of the external interface should bear the source > address of the external interface - pretty standard. But you're also saying > that any packet going out of the *internal* interface should also have the > source address of the external interface - why ??? > > Do you have any access control rules on your SMTP server - is it fussy about > the IP addresses it accepts connections from ? > > What happens if you telnet to port 25 on the mail server from your firewall ? > > > Antony. > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Hudin" Subject: Re: Outgoing SMTP Mystery Date: Tue, 4 Jun 2002 16:28:16 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <000f01c20c1f$81056890$5227a8c0@michael> References: <013601c20c15$cba57520$52cfd3cf@michael> <200206042237.g54MbOA10863@Networker.rockstone.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org Yeah, the internal interface was rather pointless and I've changed it to the internal gateway. It ultimately doesn't matter because the file in qmail that I'm using allows anything from the subnet and the external IP to relay. I have tried to telnet in and can get to it fine without being rejected. This one has got me stumped. -michael ----- Original Message ----- From: "Antony Stone" To: Sent: Tuesday, June 04, 2002 3:37 PM Subject: Re: Outgoing SMTP Mystery > On Tuesday 04 June 2002 11:18 pm, Michael Hudin wrote: > > > I can send SMTP out just fine, but no other server can send it in for some > > reason. > > > -A POSTROUTING -o eth0 -j SNAT --to-source 10.10.10.254 > > -A POSTROUTING -o eth1 -j SNAT --to-source 10.10.10.254 > > I really don't like the look of those two rules together. You're saying > that any packet going out of the external interface should bear the source > address of the external interface - pretty standard. But you're also saying > that any packet going out of the *internal* interface should also have the > source address of the external interface - why ??? > > Do you have any access control rules on your SMTP server - is it fussy about > the IP addresses it accepts connections from ? > > What happens if you telnet to port 25 on the mail server from your firewall ? > > > Antony. > > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Outgoing SMTP Mystery Date: Wed, 5 Jun 2002 00:46:53 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206042346.g54NksA14771@Networker.rockstone.co.uk> References: <013601c20c15$cba57520$52cfd3cf@michael> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <013601c20c15$cba57520$52cfd3cf@michael> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Tuesday 04 June 2002 11:18 pm, Michael Hudin wrote: > I've always assumed that the numbers in the brackets were port allowances No, they're not (although I can't say what they are - I don't use iptables-save). If you look at the numbers, many of them are larger than 65535, so they're certainly not port numbers :-) > Here are my tables: > > *nat > > :PREROUTING ACCEPT [241:88600] > :POSTROUTING ACCEPT [0:9862] > :OUTPUT ACCEPT [68:4275] > > *mangle > > :PREROUTING ACCEPT [18365:3221456] > :INPUT ACCEPT [10886:760348] > :FORWARD ACCEPT [7269:2438049] > :OUTPUT ACCEPT [8009:752540] > :POSTROUTING ACCEPT [15177:3182145] > > *filter > > :INPUT ACCEPT [0:229546] > :FORWARD ACCEPT [363:1553786] > :OUTPUT ACCEPT [2:619341] I find this interesting - you have a default ACCEPT policy on all your chains - specifically on FORWARD, and I cannot see any rules you have included which DROP or REJECT packets..... so is there really any filtering going on in your firewall, or is it in fact just an open router doing some network address translation !? I know this doesn't exactly solve your problem, but I wonder if it means the problem isn't on your firewall ? Perhaps you could check the routing table on your SMTP server - what does it have for a default gateway address ? Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Hudin" Subject: Re: Outgoing SMTP Mystery Date: Wed, 5 Jun 2002 10:58:43 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <001601c20cba$a1ad3a50$5227a8c0@michael> References: <013601c20c15$cba57520$52cfd3cf@michael> <200206042346.g54NksA14771@Networker.rockstone.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org Yeah, I was assuming that there were no default drop rules. I'll make sure to implement those. I did realize that my /etc/hosts file was still set to the old subnet. I corrected that, but it still is having the same problem. The gateway on the mail machine is set correctly and remember that I can POP in and out and SMTP out. I just can't get SMTP in for some mind boggling reason. -michael ----- Original Message ----- From: "Antony Stone" To: Sent: Tuesday, June 04, 2002 4:46 PM Subject: Re: Outgoing SMTP Mystery > On Tuesday 04 June 2002 11:18 pm, Michael Hudin wrote: > > > I've always assumed that the numbers in the brackets were port allowances > > No, they're not (although I can't say what they are - I don't use > iptables-save). If you look at the numbers, many of them are larger than > 65535, so they're certainly not port numbers :-) > > > Here are my tables: > > > > *nat > > > > :PREROUTING ACCEPT [241:88600] > > :POSTROUTING ACCEPT [0:9862] > > :OUTPUT ACCEPT [68:4275] > > > > *mangle > > > > :PREROUTING ACCEPT [18365:3221456] > > :INPUT ACCEPT [10886:760348] > > :FORWARD ACCEPT [7269:2438049] > > :OUTPUT ACCEPT [8009:752540] > > :POSTROUTING ACCEPT [15177:3182145] > > > > *filter > > > > :INPUT ACCEPT [0:229546] > > :FORWARD ACCEPT [363:1553786] > > :OUTPUT ACCEPT [2:619341] > > I find this interesting - you have a default ACCEPT policy on all your chains > - specifically on FORWARD, and I cannot see any rules you have included which > DROP or REJECT packets..... so is there really any filtering going on in your > firewall, or is it in fact just an open router doing some network address > translation !? > > I know this doesn't exactly solve your problem, but I wonder if it means the > problem isn't on your firewall ? > > Perhaps you could check the routing table on your SMTP server - what does it > have for a default gateway address ? > > > Antony. > > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: patrick conlin Subject: Re: Outgoing SMTP Mystery Date: Wed, 05 Jun 2002 13:58:49 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: References: <200206042346.g54NksA14771@Networker.rockstone.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7BIT Return-path: In-Reply-To: <200206042346.g54NksA14771@Networker.rockstone.co.uk> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Antony Stone , netfilter@lists.samba.org Just as a side note, the numbers in the brackets are how iptables-save/restore keeps the counter information. [packets:bytes] on 6/4/02 19:46, Antony@Soft-Solutions.co.uk wrote: >> :PREROUTING ACCEPT [241:88600] -=p=- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Hudin" Subject: Re: Outgoing SMTP Mystery Date: Wed, 5 Jun 2002 11:21:09 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <003a01c20cbd$c3ca9120$5227a8c0@michael> References: <3A5DC36EC1506C40825C05BE65E62AEF0E79EC@neptuno.idea.com.mx> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org That would be a good way to test. Unfortunately I don't have telnet setup on any machines that are external to the firewall and have qmail running. When I went to port 25 using telnet, it did appear to authenticate me through one of the usernames, but I may be mistaken since I'm not very knowledgeable about telnet. Omar, thanks for the offlist help with the port forwarding by the way. This has to be one of the useful and helpful groups of people out there. -michael ----- Original Message ----- From: "Omar Castaneda Acosta" To: "Michael Hudin" Sent: Wednesday, June 05, 2002 11:03 AM Subject: RE: Outgoing SMTP Mystery Well, if you can connect to port 25 from the someplace on the external side of your firewall, then the port forwarding is working ok. try manually (using telnet) sending an email thru a connection being portfw'ed to your qmail server. -----Original Message----- From: Michael Hudin [mailto:hudin@zoetrope.com] Sent: Wednesday, June 05, 2002 11:59 AM To: netfilter@lists.samba.org Subject: Re: Outgoing SMTP Mystery Yeah, I was assuming that there were no default drop rules. I'll make sure to implement those. I did realize that my /etc/hosts file was still set to the old subnet. I corrected that, but it still is having the same problem. The gateway on the mail machine is set correctly and remember that I can POP in and out and SMTP out. I just can't get SMTP in for some mind boggling reason. -michael ----- Original Message ----- From: "Antony Stone" To: Sent: Tuesday, June 04, 2002 4:46 PM Subject: Re: Outgoing SMTP Mystery > On Tuesday 04 June 2002 11:18 pm, Michael Hudin wrote: > > > I've always assumed that the numbers in the brackets were port allowances > > No, they're not (although I can't say what they are - I don't use > iptables-save). If you look at the numbers, many of them are larger than > 65535, so they're certainly not port numbers :-) > > > Here are my tables: > > > > *nat > > > > :PREROUTING ACCEPT [241:88600] > > :POSTROUTING ACCEPT [0:9862] > > :OUTPUT ACCEPT [68:4275] > > > > *mangle > > > > :PREROUTING ACCEPT [18365:3221456] > > :INPUT ACCEPT [10886:760348] > > :FORWARD ACCEPT [7269:2438049] > > :OUTPUT ACCEPT [8009:752540] > > :POSTROUTING ACCEPT [15177:3182145] > > > > *filter > > > > :INPUT ACCEPT [0:229546] > > :FORWARD ACCEPT [363:1553786] > > :OUTPUT ACCEPT [2:619341] > > I find this interesting - you have a default ACCEPT policy on all your chains > - specifically on FORWARD, and I cannot see any rules you have included which > DROP or REJECT packets..... so is there really any filtering going on in your > firewall, or is it in fact just an open router doing some network address > translation !? > > I know this doesn't exactly solve your problem, but I wonder if it means the > problem isn't on your firewall ? > > Perhaps you could check the routing table on your SMTP server - what does it > have for a default gateway address ? > > > Antony. > > >