On 2011-07-08 Jeffrey Starin wrote: > When I turn off the firewall (which I am loath to do) to my VPS I am > able to use the command smtp_bind_address just fine. > > Otherwise, with firewall turned on, I am getting these time out > errors in my maillog files: > > Jul 7 13:00:04 who postfix/pickup[36846]: 1F3274160009: uid=10003 > from=<blabla...@mydomain.com> > Jul 7 13:00:04 who postfix/cleanup[38864]: 1F3274160009: > message-id=<20110707170002.38758.1650417736.sw...@www.mydomain.com> > Jul 7 13:00:04 who postfix/qmgr[36847]: 1F3274160009: > from=<blablabla@mydomain>, size=996, nrcpt=1 (queue active) > Jul 7 13:00:34 who postfix/smtp[40187]: connect to > 127.0.0.1[127.0.0.1]: Connection timed out (port 10027) > Jul 7 13:00:34 who postfix/smtp[40187]: 1F3274160009: > to=<blublu...@gmail.com>, relay=none, delay=32, delays=1.9/0.01/30/0, > dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]: > Connection timed out) > > I cannot find in the following list of rules (which is the default > iptables policy for the hosting company I use) what is causing the > connection timed out issue. If someone sees something please advise > what needs to be done. I am at my wits end with this problem. Thank > you. > > Chain INPUT (policy ACCEPT) > target prot opt source destination > ACCEPT icmp -- anywhere anywhere icmp
Almost 400 rules with tons of duplicates in them? You gotta be kidding. Nobody's gonna bother checking these (unless they have A LOT of free time on their hands). Seriously, clean your ruleset (or rather: rebuild it from scratch) before you try anything else. As Harald already pointed out: for connections to localhost something like iptables -A INPUT -i lo -j ACCEPT is perfectly fine. And unless you have rather strict security requirements (in which case your ruleset would allow far less protocols to begin with), you can simply accept everything in the OUTPUT chain: iptables -P OUTPUT ACCEPT Also, when posting your tables somewhere, use "iptables -nL" rather than just "iptables -L". Regards Ansgar Wiechers -- "Abstractions save us time working, but they don't save us time learning." --Joel Spolsky
