1

So using a VPS environment, whereby we need to block outbound SMTP by default (spammers), with the ability to unblock when needed.

We have found some scripts eg:
iptables -I FORWARD 1 -d $VPS_IP -p tcp -m tcp --dport 25 -j DROP
iptables -I FORWARD 1 -s $VPS_IP -p tcp -m tcp --dport 25 -j DROP

and
iptables -I FORWARD -p tcp --sport 25 -j DROP
iptables -I FORWARD -p tcp --dport 25 -j DROP

However controlling the blocking via the first set is inefficient, especially when the range of IPs can be changing.

So the question is, if we use set 2 (blanket block), how do we allow certain IPs? I'm guessing we need to add something to the OUTPUT chain, however wouldn't the blanket block be processed first? Or if we add to FORWARD, since they are further down the chain, wouldn't the blanket block go first? etc..

The iptables -L looks like:

[root@server ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
SOLUSVM_TRAFFIC_IN  all  --  anywhere             anywhere
SOLUSVM_TRAFFIC_OUT  all  --  anywhere             anywhere
       all  --  somedomain  anywhere
       all  --  anywhere             somedomain  

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain SOLUSVM_TRAFFIC_IN (1 references)
target     prot opt source               destination
       all  --  anywhere             somedomain  

Chain SOLUSVM_TRAFFIC_OUT (1 references)
target     prot opt source               destination
       all  --  somedomain    anywhere

Much appreciated! (going to post a job on coders for hire or something if it isn't answered)

  • What's the nature of the IP's? Ranges or a list? – slm Apr 11 '14 at 0:01
  • well in this case its a /24, that i blanket ban, but it will be a list of individual ips (hopefully that i can put into a file and run a script on). – Joshua D'Alton Apr 11 '14 at 3:40
1

It is possible to use an insert command to add the rules ahead of the blocking rules. However, only 1 or possibly 2 servers should be sending email to the Internet. If necessary add firewall rules on your hosts to allow only their mail server to send email. This should disable bots, or at least provide the ability to log and trace the problem.

I would recommend you set up one outgoing mail server and block all other servers sending email to the Internet. Use that mail server as the outgoing MTA (Mail Transfer Agent) for all hosts in your network. Configure it properly with rDNS, SPF, etc. Domains which don't send email should have SPF records containing a '-all' policy. See my notes on Securing your Email Reputation with SPF.

Configure you email server to limit which domain(s) you will send on behalf of. I find the ACL capabilities of Exim works well for this. You may also want to install limit rules to prevent high volumes of outgoing email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.