To configure ipchains to allow inbound mail to pass thru to an internal server and outbound mail from the internal server.

MY LINUX SERVER SERVERS AS PASS TRHU FOR INTERNET MAIL BETWEEN THE INTERNET AND INTERNAL NETWORK.  MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT
TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE
INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN
ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE
SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS
IT OUT TO THE INTERNET.
THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES to accept only smtp and then NO MAIL IS TRANSFERRED
IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS
OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY
QUEUED AND NOT SENT.

THANKS





RabeycAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

DVBCommented:
What about DNS? Email needs DNS. Working DNS. For the proxy server:
Make a stripped down install of your distro. Install a good SMTP server like postfix/qmail/exim/sendmail. Configure the server to only accept mails for your domain, and to relay  for your ip block. Install rbldns on this server, listening only to an internal interface.
Don't bother about a packet filtering firewall on a SMTP proxy running only SMTP on the public interface.
If you still need a firewall:
/sbin/ipchains -P input DENY
/sbin/ipchains -A input -s 0.0.0.0/0 -d $EXT_IP 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $exchange_server/32 -d $INT_IP 25 -i $int_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $EXT_IP -d 0.0.0.0/0 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $INT_IP -d $exchange_server 25 -i $int_if  -p tcp -j ACCEPT

/sbin/ipchains -A input -s $DNS_SERVER 53 -p udp -j ACCEPT.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pjb1008Commented:
Regarding the firewall rules:

If a DNS packet is too small to contain a DNS reply, a client will automatically switch to using tcp, therefore you need:
/sbin/ipchains -A input -s $DNS_SERVER 53 -p tcp -y -j ACCEPT

Some machines require icmp echo to work to do pMTU discovery. Likewise, you'll need fragmentation-needed etc.
I would have:
/sbin/ipchains -A input -p icmp -j ACCEPT

I *highly* recommend setting the default policy to REJECT, not DENY. This has negligable impact on security, but improves the ability to debug probems considerably. Better still, put a logging REJECT rule at the end of the input chain.
0
CleanupPingCommented:
Rabeyc:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
paullamhkgCommented:
No comment has been added lately, so it's time to clean up this TA.
I will leave the following recommendation for this question in the Cleanup topic area:

Split: DVB {http:#7044627} & pjb1008 {http:#7251594}

Please leave any comments here within the next seven days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

paullamhkg
EE Cleanup Volunteer
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Networking

From novice to tech pro — start learning today.