postfix doesn't work after iptables set up

thkang asked:

here’s my problem:

# iptables -P INPUT DROP
# host -t mx gmail.com
;; connection timed out; no servers could be reached
# iptables -P INPUT ACCEPT
# host -t mx gmail.com
gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.

after setting iptables to drop all input packets unless specified otherwise, I can’t resolve hosts and therefore postfix fails to send mails. I think it is crucial to set firewall up – what is the firewall setting that I missed?

here’s my current iptables:

# iptables -L INPUT -n -v
Chain INPUT (policy ACCEPT 120 packets, 17552 bytes)
 pkts bytes target     prot opt in     out     source               destination          
2669K  160M fail2ban-ssh-ddos  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
2669K  160M fail2ban-ssh  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
  122 19135 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
  252 27262 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:143
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:587
   46  3191 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21
  264 2459K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0 

My answer:


You’re missing a rule to accept traffic based on existing traffic (the rule that makes iptables stateful). This should be your very first rule:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.