Solved

What are the Linux firewall rules for  only email data and is there a way for Linux to control <br><br><br>unsolicited mail?  

Posted on 2002-04-24
6
221 Views
Last Modified: 2010-03-18

MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS IT OUT TO THE INTERNET.
ALL THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES AS DESCRIBED BELOW NO MAIL IS TRANSFERRED IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY QUEUED AND NOT SENT.

THANKS





With the ipchains firewall rules mail is not being relayed in any direction.  If all my outbound mail is routed to my Linux server from one internal server shouldn't this be factored in the firewall rules?

The iptables options did not work maybe I don't have it enabled.

The ipchains options worked.  I then enabled IP forwarding.
Subsequently I could not browse on the Internet or even ping the server which is fine!  However, I rebooted and then I could browse again from the server.  Does rebooting reset the ipchain settings? If so, do I need to reapply the commands?

Thanks
rabeyc



This Linux server is intended only to route mail (pass thru).  However, I would like to configure the Linux firewall to block all other types of connections and data and would like to know where and how to configure Linux to achieve that.

Thanks
rabeyc
0
Comment
Question by:Rabeyc
6 Comments
 
LVL 51

Expert Comment

by:ahoffmann
Comment Utility
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A FORWARD -p tcp -d your-mailserver --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -s your-mailserver --dport 25 -j ACCEPT

> .. control or stop unsolicited mail ..
what exactly is unsolicited mail in your terms?
0
 

Accepted Solution

by:
zdpl0a earned 200 total points
Comment Utility
or the following for ipchains

ipchains -F
ipchains -P input DENY
ipchains -P output DENY
ipchains -P forward DENY
ipchains -A forward -p tcp -d your-mailserver 25 -j ACCEPT
ipchains -A forward -p tcp -s your-mailserver 25 -j ACCEPT
0
 
LVL 10

Expert Comment

by:kiranghag
Comment Utility
rebooting does remove the rules ( this had won me a prize in an networking contest)
two questions to solve, on on linux, other windows.
i could do the linux first rebooted to windows, solved it. later when back to linux, i could solve the linux one also....:)))) )
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 3

Expert Comment

by:hnminh
Comment Utility
Dealing with junk mail is a different story from these firewall rules, depending on your current email server software. Let people know the software if you still want to go on with this issue...
0
 

Author Comment

by:Rabeyc
Comment Utility
The answer did not quite resolve the problem. Actually I stopped getting mail inbound and outbound and had to disable the ipchains by rebooting.
0
 

Author Comment

by:Rabeyc
Comment Utility
The answer did not quite resolve the problem. Actually I stopped getting mail inbound and outbound and had to disable the ipchains by rebooting.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now