Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

To configure ipchains to allow inbound mail to pass thru to an internal server and outbound mail from the internal server.

Posted on 2002-05-28
5
Medium Priority
?
395 Views
Last Modified: 2010-03-18
MY LINUX SERVER SERVERS AS PASS TRHU FOR INTERNET MAIL BETWEEN THE INTERNET AND INTERNAL NETWORK.  MY LINUX SERVER IS AN INTERMEDIARY BETWEEN THE INTERNET AND MY INTERNAL NETWORK.  IT USES A NIC TO CONNECT
TO THE INTERNET AND A SECOND NIC TO CONNECT TO THE INTERNAL NETWORK.  INBOUND MAIL COMES IN FROM THE
INTERNET TO THE LINUX SERVER WHICH IS THE DEFINED EMAIL SERVER ON THE INTERNIC.  THE LINUX SERVER THEN
ROUTES ALL MAIL WITH THE DOMAIN ADDRESS TO THE INTERNAL NETWORK TO A WINNT SERVER WHICH HAS MS EXCANGE
SERVER 5.5.  
OUTBOUND MAIL IS RECEIVED BY THE INTERNAL EXCHANGE SERVER AND ROUTED TO THE LINUX SERVER WHICH SENDS
IT OUT TO THE INTERNET.
THE ABOVE WORKS WELL EXCEPT WHEN I ENABLE THE IPCHAINS RULES to accept only smtp and then NO MAIL IS TRANSFERRED
IN EITHER DIRECTIONS.
IT SEEMS THAT THE RULES NEED TO CHANGE FOR THE SCENARIO DESCRIBED ABOVE.  I HAVE TRIED MANY COMBINATIONS
OF RULES TO CONFIGURE IT TO ACCEPT ONLY MAIL AND TO BLOCK ALL OTHER SERVICES BUT THE MAIL IS STILL ONLY
QUEUED AND NOT SENT.

THANKS





0
Comment
Question by:Rabeyc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 3

Accepted Solution

by:
DVB earned 400 total points
ID: 7044627
What about DNS? Email needs DNS. Working DNS. For the proxy server:
Make a stripped down install of your distro. Install a good SMTP server like postfix/qmail/exim/sendmail. Configure the server to only accept mails for your domain, and to relay  for your ip block. Install rbldns on this server, listening only to an internal interface.
Don't bother about a packet filtering firewall on a SMTP proxy running only SMTP on the public interface.
If you still need a firewall:
/sbin/ipchains -P input DENY
/sbin/ipchains -A input -s 0.0.0.0/0 -d $EXT_IP 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $exchange_server/32 -d $INT_IP 25 -i $int_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $EXT_IP -d 0.0.0.0/0 25 -i $ext_if -p tcp -j ACCEPT
/sbin/ipchains -A input -s $INT_IP -d $exchange_server 25 -i $int_if  -p tcp -j ACCEPT

/sbin/ipchains -A input -s $DNS_SERVER 53 -p udp -j ACCEPT.
0
 
LVL 3

Assisted Solution

by:pjb1008
pjb1008 earned 400 total points
ID: 7251594
Regarding the firewall rules:

If a DNS packet is too small to contain a DNS reply, a client will automatically switch to using tcp, therefore you need:
/sbin/ipchains -A input -s $DNS_SERVER 53 -p tcp -y -j ACCEPT

Some machines require icmp echo to work to do pMTU discovery. Likewise, you'll need fragmentation-needed etc.
I would have:
/sbin/ipchains -A input -p icmp -j ACCEPT

I *highly* recommend setting the default policy to REJECT, not DENY. This has negligable impact on security, but improves the ability to debug probems considerably. Better still, put a logging REJECT rule at the end of the input chain.
0
 

Expert Comment

by:CleanupPing
ID: 9078478
Rabeyc:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 
LVL 12

Expert Comment

by:paullamhkg
ID: 10004278
No comment has been added lately, so it's time to clean up this TA.
I will leave the following recommendation for this question in the Cleanup topic area:

Split: DVB {http:#7044627} & pjb1008 {http:#7251594}

Please leave any comments here within the next seven days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

paullamhkg
EE Cleanup Volunteer
0

Featured Post

RHCE - Red Hat OpenStack Prep Course

This course will provide in-depth training so that students who currently hold the EX200 & EX210 certifications can sit for the EX310 exam. Students will learn how to deploy & manage a full Red Hat environment with Ceph block storage, & integrate Ceph into other OpenStack service

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
Suggested Courses

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question