I am trying to block all SMTP out of my network, that is not from my internal mail server address.So i would just like to know if there could be anything i am missing or perhaps anything i could improve on my current iptable rules for my mail server.iptables -I FORWARD -p tcp --dport 25 -j DROPiptables -I FORWARD -p tcp --dport 25 -j LOG --log-prefix FORWARD-SMTP-DROP: iptables -I FORWARD -p tcp -s <SMTP IP HERE> --dport 25 -j ACCEPTiptables -I FORWARD -p tcp -d <SMTP IP HERE> --dport 25 -j ACCEPTiptables -I OUTPUT -p tcp -m multiport --dport 25,465,587 -s ! <SMTP IP HERE> -j DROPiptables -I OUTPUT -p tcp -m multiport --dport 25,465,587 -s ! <SMTP IP HERE> -j LOG --log-prefix OUTPUT-SMTP-DROP: Thanks in advance :)
iptables and securing an smtp
iptables
If your standard policy of iptables in the FORWARD-chain is DROP you can remove the first line.Additionally (for more security) you can add the ingoing and outgoing interfaces of the smtp-traffic to line 3 and 4.iptables -I FORWARD -o <OUTGOING IF> -i <INGOING IF> -p tcp -s <SMTP IP HERE> --dport 25 -j ACCEPTiptables -I FORWARD -o <OUTGOING IF> -i <INGOING IF> -p tcp -d <SMTP IP HERE> --dport 25 -j ACCEPTJust add the correct interface names of the firewall. The reason for this is quite simple: IP-Addresses can easily be spoofed, but of course you can not so easily spoof the physical interface the traffic is coming in or out. Apart from that the rules seem quite ok to me. Just try if it works as you meant it to work and see if there is any unexpected behaviour.Greatings, Darth Ravage