Can someone help me, this is driving me nuts!
I currently run sendmail on port 25, I have had a requirement to install
smtp_auth, which all works fine. However I now find out that one of my
users ISP's blocks port 25 so he can't access the mail anyway.
The answer? NAT port 10025 or what ever to port 25.
The solution?
I followed the firewall instructions and set up a rule, but it does not
seem to work, here's my iptables file, and the output from an iptables
list. Can anyone tell me what stupid mistake I have made.
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 143 --state NEW -j
ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 993 --state NEW -j
ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 2049 --state NEW
-j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 25 --state NEW -j
ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 80 --state NEW -j
ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 443 --state NEW -j
ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 22 --state NEW -j
ACCEPT
# Accept connections for webmin
-A RH-Firewall-1-INPUT -p tcp -m tcp -s 1.2.3.0/255.255.255.0 -i eth0
--dport 10000 -j ACCEPT
# Accept SMTP_AUTH on 10025
-A RH-Firewall-1-INPUT -p tcp -m tcp -m state --dport 10025 --state NEW
-j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# SMTP_AUTH
-A PREROUTING -p tcp -m tcp -d 1.2.3.4 -i eth0:3 --dport 10025 -j DNAT
--to-destination 1.2.3.4:25
COMMIT
# Completed
NAT table :
Chain PREROUTING (policy ACCEPT 109 packets, 10385 bytes)
pkts bytes target prot opt in out source
destination
0 0 DNAT tcp -- eth0:3 any anywhere
host.mydomain.uk tcp dpt:10025 to:1.2.3.4:25
Chain POSTROUTING (policy ACCEPT 647 packets, 48457 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 647 packets, 48457 bytes)
pkts bytes target prot opt in out source
destination
Chains :
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
208K 273M RH-Firewall-1-INPUT all -- any any
anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 RH-Firewall-1-INPUT all -- any any
anywhere anywhere
Chain OUTPUT (policy ACCEPT 131K packets, 29M bytes)
pkts bytes target prot opt in out source
destination
Chain RH-Firewall-1-INPUT (2 references)
pkts bytes target prot opt in out source
destination
416 23160 ACCEPT all -- lo any anywhere
anywhere
18 504 ACCEPT icmp -- any any anywhere
anywhere icmp any
0 0 ACCEPT ipv6-crypt-- any any anywhere
anywhere
0 0 ACCEPT ipv6-auth-- any any anywhere
anywhere
208K 273M ACCEPT all -- any any anywhere
anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:imap
2 284 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:imaps
0 0 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:nfs
8 352 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:smtp
0 0 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:http
0 0 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:https
1 100 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:ssh
1 60 ACCEPT tcp -- eth0 any 1.2.3.0/24
anywhere tcp dpt:10000
0 0 ACCEPT tcp -- any any anywhere
anywhere state NEW tcp dpt:10025
77 9053 REJECT all -- any any anywhere
anywhere reject-with icmp-host-prohibited
Many thanks,
Neil.
--
Neil Marjoram.
Systems Manager
University College London
Adastral Park Campus
Martlesham Heath
Ipswich
Suffolk
IP5 3RL
