Usually people leave OUTPUT defaulting to ACCEPT. The problem may be that you set OUTPUT to default to DROP, but allowed established connection on INPUT only. So these rules should be enough: -A INPUT -p tcp -dport 25 -j ACCEPT Also, only the OUTPUT -dport 25 line matters for sending emails. Only the INPUT line matters for receiving emails.

If I remove the first OUTPUT line then my server won't receive emails & if I remove the last line it won't send emails. Every connection will have a random source port, so there's nothing to match on. The source and destination don't depend on direction - they're match on the packet's source and destination ports. All input packets should come to port 25, and all output packets be sent from 25? What am I missing?įor SMTP you don't need any -sport rule. My current understanding says an SMTP packet should always match one of these two rules. Shouldn't:īe enough to let everything through? AFAIK all SMTP communication should go over 25, 587 or 465. *these 3 lines also exist verbatim for ports 587 & 465 A OUTPUT -p tcp -sport 25 -j ACCEPT //needed for sending? A OUTPUT -p tcp -dport 25 -j ACCEPT //needed for receiving? A INPUT -m state -state ESTABLISHED,RELATED -j ACCEPT I have the following rules related to SMTP: Let me start by saying that I'm creating a white list, so all policies (INPUT, FORWARD, OUTPUT) default to DROP. I know it acts as a filter but something isn't clicking because it isn't working the way I think it should. I am having some trouble understanding iptables.

Iptables dport