CentOS

Hello,

I'm having trouble with iptables. I cannot get SMTP (port 25) and DNS (port 53) to show up in NMAP. NMAP says the service is up, but it's blocked...and I'm clueless what else I can do (I've done numerous how-tos and configurations).


Any help/advice would be greatly appreciated. I just need to services up, they do not need to point to any specific server. My configuration is below:


# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

#DNS
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 993 -j ACCEPT

# SMTP
-A INPUT -m state --state NEW,ESTABLISHED -m tcp -p tcp --sport 1024:65535 --dport 25 -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED -m tcp -p tcp --sport 25 --dport 1024:65535 -j ACCEPT

#Others
-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 995 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

[quote]
Sownder wrote:
Hello,

I'm having trouble with iptables. I cannot get SMTP (port 25) and DNS (port 53) to show up in NMAP. NMAP says the service is up, but it's blocked...and I'm clueless what else I can do (I've done numerous how-tos and configurations). [/quote]
Have you verified that the correct services are running? From where are you trying to connect? ISPs often block ports.

[quote]
... I just need to services up, they do not need to point to any specific server. [/quote]
Not sure what that means. The firewall is for the [b]server[/b] on which it is running. A specific [b]service[/b], such as sendmail or postfix, will listen on a specific open port.

You may want to check [b]iptables-save[/b] to verify the active rules.