To configure ipchains to allow inbound mail to pass thru to an internal server and outbound mail from the internal server.

MY LINUX SERVER SERVERS AS PASS TRHU FOR INTERNET MAIL BETWEEN THE INTERNET AND INTERNAL NETWORK.  MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT
TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE
INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN
ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE
SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS
IT OUT TO THE INTERNET.
THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES to accept only smtp and then NO MAIL IS TRANSFERRED
IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS
OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY
QUEUED AND NOT SENT.

THANKS





RabeycAsked:
Who is Participating?
 
DVBCommented:
What about DNS? Email needs DNS. Working DNS. For the proxy server:
Make a stripped down install of your distro. Install a good SMTP server like postfix/qmail/exim/sendmail. Configure the server to only accept mails for your domain, and to relay  for your ip block. Install rbldns on this server, listening only to an internal interface.
Don't bother about a packet filtering firewall on a SMTP proxy running only SMTP on the public interface.
If you still need a firewall:
/sbin/ipchains -P input DENY
/sbin/ipchains -A input -s 0.0.0.0/0 -d $EXT_IP 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $exchange_server/32 -d $INT_IP 25 -i $int_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $EXT_IP -d 0.0.0.0/0 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $INT_IP -d $exchange_server 25 -i $int_if  -p tcp -j ACCEPT

/sbin/ipchains -A input -s $DNS_SERVER 53 -p udp -j ACCEPT.
0
 
pjb1008Commented:
Regarding the firewall rules:

If a DNS packet is too small to contain a DNS reply, a client will automatically switch to using tcp, therefore you need:
/sbin/ipchains -A input -s $DNS_SERVER 53 -p tcp -y -j ACCEPT

Some machines require icmp echo to work to do pMTU discovery. Likewise, you'll need fragmentation-needed etc.
I would have:
/sbin/ipchains -A input -p icmp -j ACCEPT

I *highly* recommend setting the default policy to REJECT, not DENY. This has negligable impact on security, but improves the ability to debug probems considerably. Better still, put a logging REJECT rule at the end of the input chain.
0
 
CleanupPingCommented:
Rabeyc:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 
paullamhkgCommented:
No comment has been added lately, so it's time to clean up this TA.
I will leave the following recommendation for this question in the Cleanup topic area:

Split: DVB {http:#7044627} & pjb1008 {http:#7251594}

Please leave any comments here within the next seven days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

paullamhkg
EE Cleanup Volunteer
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.