Results 1 to 7 of 7

Thread: zimbra routing issues

  1. #1
    yaboo is offline Intermediate Member
    Join Date
    Feb 2008
    Posts
    16
    Rep Power
    7

    Default zimbra routing issues

    Hi All

    Zimbra is up and running. I am trying now to route port 25 from the main machine with the dsl to the internal natted machine.

    the current iptables rules I am using are as follows

    $IPTABLES -t nat -A PREROUTING -i ppp0 -p tcp --dport 25 -j DNAT --to-destination 192.168.0.2:25

    and

    $IPTABLES -A FORWARD -p tcp --dport 25 -j ACCEPT -s 192.168.0.2

    neither of these rules work, what would be the syntax I would use.

    Joseph

  2. #2
    phoenix is online now Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,201
    Rep Power
    56

    Default

    What do you mean by 'they don't work'?
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    yaboo is offline Intermediate Member
    Join Date
    Feb 2008
    Posts
    16
    Rep Power
    7

    Default

    Also forgot to mention that I changed the server from the primary mx and secondary mx. also the secondary mx is natted.

    Joseph

  4. #4
    yaboo is offline Intermediate Member
    Join Date
    Feb 2008
    Posts
    16
    Rep Power
    7

    Default

    phoenix

    those iptables rules seem not to work for me. When I try to telnet to port 25 from the outside to my machine. I get connection refused. When I try internally, I do not have a problem.

    Joseph

  5. #5
    Stergil is offline Senior Member
    Join Date
    May 2007
    Posts
    71
    Rep Power
    7

    Default

    I pulled this out of my firewall script, hope it helps.

    My firewall/router is a dual homed Linux box. Substitute your proper interface(s) and appropriate IP addresses for any of the $VARIABLES as needed.

    for my install, IPTABLES="/sbin/iptables".


    Code:
    # --------------------------------------
    # inbound smtp/mail (25)
    # --------------------------------------
    echo ""
    echo -n "Accept inbound mail requests from the Internet"
    $IPTABLES -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $EXTERNAL_ADDRESS --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
    $IPTABLES -A OUTPUT -p tcp -s $EXTERNAL_ADDRESS --sport 25 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
    
    echo ""
    echo -n "Forwarding incoming port 25 traffic to mail server"
    $IPTABLES -t nat -A PREROUTING -p tcp -i $EXTERNAL_INTERFACE -s 0/0 --sport 1024:65535 -d 0/0 --dport 25 -m state --state NEW,ESTABLISHED -j DNAT --to-dest $MAIL_SERVER
    $IPTABLES -A FORWARD -p tcp -i $EXTERNAL_INTERFACE -s 0/0 --sport 1024:65535 -o $INTERNAL_INTERFACE -d $MAIL_SERVER --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
    $IPTABLES -A FORWARD -p tcp -i $INTERNAL_INTERFACE -s $MAIL_SERVER --sport 25 -o $EXTERNAL_INTERFACE -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
    $IPTABLES -t nat -A POSTROUTING -p tcp -o $EXTERNAL_INTERFACE -s $MAIL_SERVER --sport 25 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j MASQUERADE
    Last edited by Stergil; 02-20-2008 at 12:17 AM.

  6. #6
    phoenix is online now Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,201
    Rep Power
    56

    Default

    There's also some detail on the wiki about iptables.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  7. #7
    yaboo is offline Intermediate Member
    Join Date
    Feb 2008
    Posts
    16
    Rep Power
    7

    Default

    Hi Guys

    here is my firewall rules, see what I am doing wrong.

    #!/bin/sh

    IPTABLES=/sbin/iptables

    /sbin/modprobe ipt_MASQUERADE
    $IPTABLES -F
    $IPTABLES -t nat -F
    $IPTABLES -t mangle -F
    $IPTABLES -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
    $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    $IPTABLES -A INPUT -m state --state NEW -i ! ppp0 -j ACCEPT
    #
    # ftp
    #
    #$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
    #$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
    #
    # ssh
    #
    $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
    #
    # mail
    #
    $IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 25 -j DNAT --to 192.168.0.2:25
    $IPTABLES -A FORWARD -p tcp -i ppp0 -d 192.168.0.2 --dport 25 -j ACCEPT
    #
    # domain name services
    #
    $IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT
    $IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT
    #
    # world wide web
    #
    $IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
    $IPTABLES -t nat -A PREROUTING -p tcp -i ppp0 --dport 81 -j DNAT --to 192.168.0.2:80
    $IPTABLES -A FORWARD -p tcp -i ppp0 -d 192.168.0.2 --dport 81 -j ACCEPT
    $IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT
    #
    # irc
    #
    $IPTABLES -A INPUT -p tcp --dport 113 -j ACCEPT
    #
    # network time protocol
    #
    $IPTABLES -A INPUT -p tcp --dport 123 -j ACCEPT
    $IPTABLES -P INPUT DROP
    $IPTABLES -A FORWARD -i eth1 -o eth1 -j REJECT
    /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
    /bin/echo 1 > /proc/sys/net/ipv4/ip_no_pmtu_disc
    /bin/echo "2048 32767" > /proc/sys/net/ipv4/ip_local_port_range

    Can you point out the errors.

    Joseph

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. QUE Failure
    By tbullock in forum Administrators
    Replies: 31
    Last Post: 07-30-2008, 12:17 PM
  2. [SOLVED] Spam Being Sent Thru Server - Help Needed!
    By msf004 in forum Administrators
    Replies: 22
    Last Post: 03-14-2008, 11:11 PM
  3. Replies: 8
    Last Post: 02-27-2007, 04:10 AM
  4. dspam logrotate errors
    By michaeln in forum Users
    Replies: 7
    Last Post: 02-19-2007, 12:45 PM
  5. Unable to start tomcat
    By chanck in forum Administrators
    Replies: 11
    Last Post: 06-11-2006, 12:58 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •