Solved

To configure ipchains to allow inbound mail to pass thru to an internal server and outbound mail from the internal server.

Posted on 2002-05-28
5
391 Views
Last Modified: 2010-03-18
MY LINUX SERVER SERVERS AS PASS TRHU FOR INTERNET MAIL BETWEEN THE INTERNET AND INTERNAL NETWORK.  MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT
TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE
INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN
ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE
SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS
IT OUT TO THE INTERNET.
THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES to accept only smtp and then NO MAIL IS TRANSFERRED
IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS
OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY
QUEUED AND NOT SENT.

THANKS





0
Comment
Question by:Rabeyc
5 Comments
 
LVL 3

Accepted Solution

by:
DVB earned 100 total points
ID: 7044627
What about DNS? Email needs DNS. Working DNS. For the proxy server:
Make a stripped down install of your distro. Install a good SMTP server like postfix/qmail/exim/sendmail. Configure the server to only accept mails for your domain, and to relay  for your ip block. Install rbldns on this server, listening only to an internal interface.
Don't bother about a packet filtering firewall on a SMTP proxy running only SMTP on the public interface.
If you still need a firewall:
/sbin/ipchains -P input DENY
/sbin/ipchains -A input -s 0.0.0.0/0 -d $EXT_IP 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $exchange_server/32 -d $INT_IP 25 -i $int_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $EXT_IP -d 0.0.0.0/0 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $INT_IP -d $exchange_server 25 -i $int_if  -p tcp -j ACCEPT

/sbin/ipchains -A input -s $DNS_SERVER 53 -p udp -j ACCEPT.
0
 
LVL 3

Assisted Solution

by:pjb1008
pjb1008 earned 100 total points
ID: 7251594
Regarding the firewall rules:

If a DNS packet is too small to contain a DNS reply, a client will automatically switch to using tcp, therefore you need:
/sbin/ipchains -A input -s $DNS_SERVER 53 -p tcp -y -j ACCEPT

Some machines require icmp echo to work to do pMTU discovery. Likewise, you'll need fragmentation-needed etc.
I would have:
/sbin/ipchains -A input -p icmp -j ACCEPT

I *highly* recommend setting the default policy to REJECT, not DENY. This has negligable impact on security, but improves the ability to debug probems considerably. Better still, put a logging REJECT rule at the end of the input chain.
0
 

Expert Comment

by:CleanupPing
ID: 9078478
Rabeyc:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 
LVL 12

Expert Comment

by:paullamhkg
ID: 10004278
No comment has been added lately, so it's time to clean up this TA.
I will leave the following recommendation for this question in the Cleanup topic area:

Split: DVB {http:#7044627} & pjb1008 {http:#7251594}

Please leave any comments here within the next seven days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

paullamhkg
EE Cleanup Volunteer
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question