zimbra routing issues

[yaboo]

Hi All

Zimbra is up and running. I am trying now to route port 25 from the main machine with the dsl to the internal natted machine.

the current iptables rules I am using are as follows

$IPTABLES -t nat -A PREROUTING -i ppp0 -p tcp --dport 25 -j DNAT --to-destination 192.168.0.2:25

and

$IPTABLES -A FORWARD -p tcp --dport 25 -j ACCEPT -s 192.168.0.2

neither of these rules work, what would be the syntax I would use.

Joseph

[phoenix]

What do you mean by 'they don't work'?

[yaboo]

Also forgot to mention that I changed the server from the primary mx and secondary mx. also the secondary mx is natted.

Joseph

[yaboo]

phoenix

those iptables rules seem not to work for me. When I try to telnet to port 25 from the outside to my machine. I get connection refused. When I try internally, I do not have a problem.

Joseph

[Stergil]

I pulled this out of my firewall script, hope it helps.

My firewall/router is a dual homed Linux box. Substitute your proper interface(s) and appropriate IP addresses for any of the $VARIABLES as needed.

for my install, IPTABLES="/sbin/iptables".

# --------------------------------------
# inbound smtp/mail (25)
# --------------------------------------
echo ""
echo -n "Accept inbound mail requests from the Internet"
$IPTABLES -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $EXTERNAL_ADDRESS --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -s $EXTERNAL_ADDRESS --sport 25 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

echo ""
echo -n "Forwarding incoming port 25 traffic to mail server"
$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTERNAL_INTERFACE -s 0/0 --sport 1024:65535 -d 0/0 --dport 25 -m state --state NEW,ESTABLISHED -j DNAT --to-dest $MAIL_SERVER
$IPTABLES -A FORWARD -p tcp -i $EXTERNAL_INTERFACE -s 0/0 --sport 1024:65535 -o $INTERNAL_INTERFACE -d $MAIL_SERVER --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -p tcp -i $INTERNAL_INTERFACE -s $MAIL_SERVER --sport 25 -o $EXTERNAL_INTERFACE -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -p tcp -o $EXTERNAL_INTERFACE -s $MAIL_SERVER --sport 25 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j MASQUERADE

[phoenix]

There's also some detail on the wiki about iptables.

[yaboo]

Hi Guys

here is my firewall rules, see what I am doing wrong.

#!/bin/sh

IPTABLES=/sbin/iptables

/sbin/modprobe ipt_MASQUERADE
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -i ! ppp0 -j ACCEPT
#
# ftp
#
#$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
#$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
#
# ssh
#
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
#
# mail
#
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 25 -j DNAT --to 192.168.0.2:25
$IPTABLES -A FORWARD -p tcp -i ppp0 -d 192.168.0.2 --dport 25 -j ACCEPT
#
# domain name services
#
$IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT
#
# world wide web
#
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 81 -j DNAT --to 192.168.0.2:80
$IPTABLES -A FORWARD -p tcp -i ppp0 -d 192.168.0.2 --dport 81 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT
#
# irc
#
$IPTABLES -A INPUT -p tcp --dport 113 -j ACCEPT
#
# network time protocol
#
$IPTABLES -A INPUT -p tcp --dport 123 -j ACCEPT
$IPTABLES -P INPUT DROP
$IPTABLES -A FORWARD -i eth1 -o eth1 -j REJECT
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
/bin/echo 1 > /proc/sys/net/ipv4/ip_no_pmtu_disc
/bin/echo "2048 32767" > /proc/sys/net/ipv4/ip_local_port_range

Can you point out the errors.

Joseph