How to allow mail through iptables?
iptables
Solution
The `OUTPUT` commands should also refer to `--dport`, not `--sport`. You'll also want to allow `NEW` outgoing packets in order to initiate the connection to the SMTP server.
In general, however, since `OUTPUT` controls only those packets that your own system generates, you can set the `OUTPUT` policy to `ACCEPT` unless you need to prevent the generation of outgoing packets.
Two more comments:
1. Jay D's suggestion to "allow everything and then start blocking specific traffic" is insecure. Never configure `iptables` this way because you'd have to know in advance which ports an attacker might use and block them all individually. Always use a whitelist instead of a blacklist if you can.
2. A hint from the trenches: when you're debugging `iptables`, it's often helpful to `-I`nsert and `-A`ppend log messages at the beginning and end of each chain, then clear the counters, and run an experiment. (In your case, issue the `mail` command.) Then check the counters and logs to understand how the packet(s) migrated through the chains and where they may have been dropped.
Problem
I'm securing my server (with iptables) so that only http and ssh ports are open and that is fine, although I use the `mail` command (server: CentOS 6.2) in some applications and it does not get through now thanks to iptables blocking everything. What ports do I allow it access to? Mail usage: `echo "{{message}}" | mail -s "{{subject}}" me@mail.com` I've tried the standard mail port 25, but I have had no success with that. Here is the current setup: ``` iptables --flush iptables -P INPUT DROP iptables -P OUTPUT DROP # incoming ssh iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT # outgoing ssh iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT #HTTP iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT # mail (does not work) iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT ``` (EDIT) ANSWER: The working iptables rule: ``` iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT ```