Email troubles behind iptables firewall

Email troubles behind iptables firewall

[Travis Crook]

Hi all,
    I have an iptables firewall setup to route web, ftp 
and email traffic to internal servers.  My internal 
servers have ip addresses in the 192.168.2. range.  
The problem I am having is that my email server is 
being used as a spam box (not by me but by someone 
else on the internet - not with my approval either).

My question is this:  Qmail is my mail server.  It is 
supposed to only allow relaying by certain clients.  
As far as I know it is set up this way.  I think the 
problem occurs because I allow 192.168.2. ip 
addresses to relay mail (i.e. everyone behind the 
firewall).  But every email coming in to the mail 
server gets a 192.168.2. ip address.  Is this 
correct?  Is there any way to pass their real ip 
address through the firewall to the mail server?

Any help would be greatly appreciated.  I can 
post the firewall script, etc. if needed.

Thanks

Travis Crook
Visions Beyond

RE: Email troubles behind iptables firewall

[Aldo S. Lagana]

> 
> Hi all,
>     I have an iptables firewall setup to route web, ftp 
> and email traffic to internal servers.  My internal 
> servers have ip addresses in the 192.168.2. range.  
> The problem I am having is that my email server is 
> being used as a spam box (not by me but by someone 
> else on the internet - not with my approval either).
> 
> My question is this:  Qmail is my mail server.  It is 
> supposed to only allow relaying by certain clients.  
> As far as I know it is set up this way.  I think the 
> problem occurs because I allow 192.168.2. ip 
> addresses to relay mail (i.e. everyone behind the 
> firewall).  But every email coming in to the mail 
> server gets a 192.168.2. ip address.  Is this 
> correct?  Is there any way to pass their real ip 
> address through the firewall to the mail server?

We had that problem (using sendmail mind you) when we were running
ipchains.  Moving to iptables has since solved that problem.  The reason
it was a problem (I think) was that we were 'redirecting' incoming
connections to an internal IP address before forwarding it.  Now with
iptables and DNAT, the mail gets directly forwarded without mangling the
source IP address - thus allowing sendmail to have rules to not allow
relay for external addresses and to allow it for internal addresses.  

So if you are correctly using iptables with DNAT it should work as you
want.

> 
> Any help would be greatly appreciated.  I can 
> post the firewall script, etc. if needed.
> 
> Thanks
> 
> Travis Crook
> Visions Beyond
> 

Re: Email troubles behind iptables firewall

[Antony Stone]

On Thursday 12 September 2002 3:30 pm, Travis Crook wrote:

> Hi all,
>     I have an iptables firewall setup to route web, ftp
> and email traffic to internal servers.  My internal
> servers have ip addresses in the 192.168.2. range.
> The problem I am having is that my email server is
> being used as a spam box (not by me but by someone
> else on the internet - not with my approval either).
>
> My question is this:  Qmail is my mail server.  It is
> supposed to only allow relaying by certain clients.
> As far as I know it is set up this way.  I think the
> problem occurs because I allow 192.168.2. ip
> addresses to relay mail (i.e. everyone behind the
> firewall).  But every email coming in to the mail
> server gets a 192.168.2. ip address.  Is this
> correct?  Is there any way to pass their real ip
> address through the firewall to the mail server?

Change the SNAT / MASQUERADE rule in your POSTROUTING chain so that it only 
applies to the external interface.

eg change:

iptables -A POSTROUTING -t nat -j SNAT --to a.b.c.d

to

iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to a.b.c.d

where eth0 is your external interface.

Antony.

-- 

There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.

Re: Email troubles behind iptables firewall

[Travis Crook]

> Is this correct?  Is there any way to pass their real ip
> > address through the firewall to the mail server?
>
> Change the SNAT / MASQUERADE rule in your POSTROUTING chain so that it
only
> applies to the external interface.
>
> eg change:
>
> iptables -A POSTROUTING -t nat -j SNAT --to a.b.c.d
>
> to
>
> iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to a.b.c.d
>
> where eth0 is your external interface.
>
> Antony.


Oh great ones of the iptables mastery!  You have solved my problem!
I thank you ever so much.

Travis Crook
Visions Beyond

Email troubles behind iptables firewall

[Travis Crook]

Hi all,
    Sorry to post from an email address not on the 
list but my other address never gets to the list 
(travis @ visionsbeyond.com ).
    I have an iptables firewall setup to route web, ftp 
and email traffic to internal servers.  My internal 
servers have ip addresses in the 192.168.2. range.  
The problem I am having is that my email server is 
being used as a spam box (not by me but by someone 
else on the internet - not with my approval either).

My question is this:  Qmail is my mail server.  It is 
supposed to only allow relaying by certain clients.  
As far as I know it is set up this way.  I think the 
problem occurs because I allow 192.168.2. ip 
addresses to relay mail (i.e. everyone behind the 
firewall).  But every email coming in to the mail 
server gets a 192.168.2. ip address.  Is this 
correct?  Is there any way to pass their real ip 
address through the firewall to the mail server?

Any help would be greatly appreciated.  I can 
post the firewall script, etc. if needed.

Thanks

Travis Crook
Visions Beyond

________________________________________________________________
GET INTERNET ACCESS FROM JUNO!
Juno offers FREE or PREMIUM Internet access for less!
Join Juno today!  For your FREE software, visit:
http://dl.www.juno.com/get/web/.