Solved

To configure ipchains to allow inbound mail to pass thru to an internal server and outbound mail from the internal server.

Posted on 2002-05-28
5
390 Views
Last Modified: 2010-03-18
MY LINUX SERVER SERVERS AS PASS TRHU FOR INTERNET MAIL BETWEEN THE INTERNET AND INTERNAL NETWORK.  MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT
TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE
INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN
ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE
SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS
IT OUT TO THE INTERNET.
THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES to accept only smtp and then NO MAIL IS TRANSFERRED
IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS
OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY
QUEUED AND NOT SENT.

THANKS





0
Comment
Question by:Rabeyc
5 Comments
 
LVL 3

Accepted Solution

by:
DVB earned 100 total points
ID: 7044627
What about DNS? Email needs DNS. Working DNS. For the proxy server:
Make a stripped down install of your distro. Install a good SMTP server like postfix/qmail/exim/sendmail. Configure the server to only accept mails for your domain, and to relay  for your ip block. Install rbldns on this server, listening only to an internal interface.
Don't bother about a packet filtering firewall on a SMTP proxy running only SMTP on the public interface.
If you still need a firewall:
/sbin/ipchains -P input DENY
/sbin/ipchains -A input -s 0.0.0.0/0 -d $EXT_IP 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $exchange_server/32 -d $INT_IP 25 -i $int_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $EXT_IP -d 0.0.0.0/0 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $INT_IP -d $exchange_server 25 -i $int_if  -p tcp -j ACCEPT

/sbin/ipchains -A input -s $DNS_SERVER 53 -p udp -j ACCEPT.
0
 
LVL 3

Assisted Solution

by:pjb1008
pjb1008 earned 100 total points
ID: 7251594
Regarding the firewall rules:

If a DNS packet is too small to contain a DNS reply, a client will automatically switch to using tcp, therefore you need:
/sbin/ipchains -A input -s $DNS_SERVER 53 -p tcp -y -j ACCEPT

Some machines require icmp echo to work to do pMTU discovery. Likewise, you'll need fragmentation-needed etc.
I would have:
/sbin/ipchains -A input -p icmp -j ACCEPT

I *highly* recommend setting the default policy to REJECT, not DENY. This has negligable impact on security, but improves the ability to debug probems considerably. Better still, put a logging REJECT rule at the end of the input chain.
0
 

Expert Comment

by:CleanupPing
ID: 9078478
Rabeyc:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 
LVL 12

Expert Comment

by:paullamhkg
ID: 10004278
No comment has been added lately, so it's time to clean up this TA.
I will leave the following recommendation for this question in the Cleanup topic area:

Split: DVB {http:#7044627} & pjb1008 {http:#7251594}

Please leave any comments here within the next seven days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

paullamhkg
EE Cleanup Volunteer
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
What antennae works with Linux? 7 80
How to get my virtual machine IP address - Virtualbox 10 81
cannot get the dns server after using openvpn client 10 105
Cron jobs 12 121
I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
In this video I am going to show you how to back up and restore Office 365 mailboxes using CodeTwo Backup for Office 365. Learn more about the tool used in this video here: http://www.codetwo.com/backup-for-office-365/ (http://www.codetwo.com/ba…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now