Topic: Modify iptables or qmail to accept traffic only from filtering service

[MSmith]

I would appreciate some guidance in setting SME Server to only accept incoming *external* SMTP traffic on a list of specific ports, please.

[stephdl]

Indeed after a quick search it is not well documented....senior dev and power admin are welcome here. After that it should be written in the wiki

[mmccarn]

I've tested & verified the commands below on SME 8.1; they should also work on SME 9:

Code: [Select]

config setprop smtpd AllowHosts a.b.c.d,x.y.z.0/24
signal-event remoteaccess-update

Note that the firewall rules for inbound smtp are controlled by the pre-SME 7 service 'smtpd' rather than 'qpsmtpd' which actually services the traffic.

The value following 'AllowHosts' is split at the comma and converted into multiple rules, one for each comma-separated value. Running the above command changes the default rule in /etc/rc.d/init.d/masq from this:

/sbin/iptables -A $NEW_InboundTCP --proto tcp --dport 25 \
        --destination $OUTERNET --src 0.0.0.0/0 --jump ACCEPT

to this:

/sbin/iptables -A $NEW_InboundTCP --proto tcp --dport 25 \
        --destination $OUTERNET --src a.b.c.d --jump ACCEPT
    /sbin/iptables -A $NEW_InboundTCP --proto tcp --dport 25 \
        --destination $OUTERNET --src x.y.z.0/24 --jump ACCEPT

Restore the default setting by deleting the AllowHosts property:

Code: [Select]

config delprop smtpd AllowHosts
signal-event remoteaccess-update


[CharlieBrady]

Note also that qmail doesn't accept any network traffic. The service which operates as an SMTP listener is qpsmtpd.

[Xavier.A]

I would appreciate some guidance in setting SME Server to only accept incoming *external* SMTP traffic on a list of specific ports, please.

MSmith :

maybe you could test something like this and verify your iptables rules :

Code: [Select]

iptables -A PREROUTING -t nat -p tcp -m multiport --dports 1025,2025 -j REDIRECT --to-port 25
iptables -t nat -vnL | grep -E \(25\|1025\|2025\)
if it works, you have to make it permanent with a templates-custom or with a script to add iptables rules after the boot.

it seems that :

Code: [Select]

config setprop smtpd TCPPorts 25,2525
signal-event email-update
signal-event remoteaccess-update
doesn' work...

or you could try to use a firewall in front of your SME, it can help you to forward your specific ports to the port 25 of your SME!

A+

[CharlieBrady]

I would appreciate some guidance in setting SME Server to only accept incoming *external* SMTP traffic on a list of specific ports, please.

I guess you are asking as a followup to your post here:

http://forums.contribs.org/index.php/topic,51895.0.html

It already accepts traffic on port 25. You can have it accept SMTP traffic on additional ports by use of the portforwarding panel. Portforward port 5252 to port 25 on localhost.

If you really need to ignore port 25, you can do:

  config setprop smtpd TCPPort 5252

but then you might have issues with your LAN clients trying to use port 25.

[Xavier.A]

MSmith :

If you don't know the difference between DNAT and REDIRECT targets, you should use the CharlieBrady solution. It's more in the SMEserver Spirit.

DNAT and REDIRECT targets are not equivalent, and they will not work the same way in every situation but in your case they will do the job

A+

[MSmith]

I've tested & verified the commands below on SME 8.1; they should also work on SME 9:

Code: [Select]

config setprop smtpd AllowHosts a.b.c.d,x.y.z.0/24
signal-event remoteaccess-update


Thanks for this, it appears to be working splendidly.

[MSmith]

Just to follow up on this, mmccarn's commands worked perfectly and, paired with the incredibly cheap SpamHero service, have cut my junk email problem down to almost nothing.

[MSmith]

I guess you are asking as a followup to your post here:

http://forums.contribs.org/index.php/topic,51895.0.html

It already accepts traffic on port 25. You can have it accept SMTP traffic on additional ports by use of the portforwarding panel. Portforward port 5252 to port 25 on localhost.

If you really need to ignore port 25, you can do:

  config setprop smtpd TCPPort 5252

but then you might have issues with your LAN clients trying to use port 25.

Thanks for that. I went with mmccarn's AllowHosts solution and it's working beautifully with SpamHero.