title: iptables --sport vs --dport. INPUT vs OUTPUT
body: <p>I am having some trouble understanding iptables.  I know it acts as a filter but something isn't <em>clicking</em> because it isn't working the way I think it should.  Let me start by saying that I'm creating a white list, so all policies (INPUT, FORWARD, OUTPUT) default to DROP.</p>
  
  <p>I have the following rules related to SMTP:</p>
  
  <p><code>-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT</code></p>
  
  <p><code>-A INPUT  -p tcp --dport 25 -j ACCEPT
  -A OUTPUT -p tcp --dport 25 -j ACCEPT //needed for receiving?
  -A OUTPUT -p tcp --sport 25 -j ACCEPT //needed for sending?</code></p>
  
  <p>*these 3 lines also exist verbatim for ports 587 &amp; 465</p>
  
  <p>If I remove the first OUTPUT line then my server won't receive emails &amp; if I remove the last line it won't send emails.  What I don't understand is why.  Shouldn't:</p>
  
  <p><code>-A INPUT -p tcp --dport 25 -j ACCEPT
  -A OUTPUT -p tcp --sport 25 -j ACCEPT</code></p>
  
  <p>be enough to let everything through?  AFAIK all SMTP communication should go over 25, 587 or 465.  My current understanding says an SMTP packet should always match one of these two rules.  All input packets should come to port 25, and all output packets be sent from 25? What am I missing?</p>