Solved

What are the Linux firewall rules for  only email data and is there a way for Linux to control <br><br><br>unsolicited mail?  

Posted on 2002-04-24
6
222 Views
Last Modified: 2010-03-18

MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS IT OUT TO THE INTERNET.
ALL THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES AS DESCRIBED BELOW NO MAIL IS TRANSFERRED IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY QUEUED AND NOT SENT.

THANKS





With the ipchains firewall rules mail is not being relayed in any direction.  If all my outbound mail is routed to my Linux server from one internal server shouldn't this be factored in the firewall rules?

The iptables options did not work maybe I don't have it enabled.

The ipchains options worked.  I then enabled IP forwarding.
Subsequently I could not browse on the Internet or even ping the server which is fine!  However, I rebooted and then I could browse again from the server.  Does rebooting reset the ipchain settings? If so, do I need to reapply the commands?

Thanks
rabeyc



This Linux server is intended only to route mail (pass thru).  However, I would like to configure the Linux firewall to block all other types of connections and data and would like to know where and how to configure Linux to achieve that.

Thanks
rabeyc
0
Comment
Question by:Rabeyc
6 Comments
 
LVL 51

Expert Comment

by:ahoffmann
ID: 6967825
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A FORWARD -p tcp -d your-mailserver --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -s your-mailserver --dport 25 -j ACCEPT

> .. control or stop unsolicited mail ..
what exactly is unsolicited mail in your terms?
0
 

Accepted Solution

by:
zdpl0a earned 200 total points
ID: 6969919
or the following for ipchains

ipchains -F
ipchains -P input DENY
ipchains -P output DENY
ipchains -P forward DENY
ipchains -A forward -p tcp -d your-mailserver 25 -j ACCEPT
ipchains -A forward -p tcp -s your-mailserver 25 -j ACCEPT
0
 
LVL 10

Expert Comment

by:kiranghag
ID: 6972887
rebooting does remove the rules ( this had won me a prize in an networking contest)
two questions to solve, on on linux, other windows.
i could do the linux first rebooted to windows, solved it. later when back to linux, i could solve the linux one also....:)))) )
0
Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

 
LVL 3

Expert Comment

by:hnminh
ID: 6975263
Dealing with junk mail is a different story from these firewall rules, depending on your current email server software. Let people know the software if you still want to go on with this issue...
0
 

Author Comment

by:Rabeyc
ID: 7040154
The answer did not quite resolve the problem. Actually I stopped getting mail inbound and outbound and had to disable the ipchains by rebooting.
0
 

Author Comment

by:Rabeyc
ID: 7040162
The answer did not quite resolve the problem. Actually I stopped getting mail inbound and outbound and had to disable the ipchains by rebooting.
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Traceroute command on mac printing * * *** 10 83
Centos Rescue and NFS Share 4 66
BIND rate-limit - DNS for web server requests 29 181
Guacamole and browser performance 1 84
I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question