I am having a problem running qmail-ldap with my iptables firewall. If I
start up the firewall, after a period of time, I cannot connect to the
qmail smptd on 25. I shut the firewall off and I can connect again. I
tried raising concurrencyincoming from 20 to 100, but that made no
difference. The server is under very light load: top - 15:40:54 up 57
days, 3:49, 1 user, load average: 0.00, 0.01, 0.00
I'm not sure where to look here, or what could be the cause.
===============================================
my patch level: qmail-ldap-1.03-20040801.patch
===============================================
Here is my qmail-smtpd run:
===============================================
#!/bin/sh
export PATH=$PATH:/usr/local/bin:/usr/bin:/usr/sbin:/usr/local/sbin
QMAILDUID=`id -u qmaild`
NOFILESGID=`id -g qmaild`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
LOCAL=`head -1 /var/qmail/control/me`
if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL"
]; then
echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in
echo /var/qmail/supervise/qmail-smtpd/run
exit 1
fi
exec /usr/local/bin/softlimit -m 10000000 \
/usr/local/bin/envdir /etc/relay-ctrl \
/usr/local/bin/relay-ctrl-chdir \
/usr/local/bin/tcpserver \
-v -R -l "$LOCAL" \
-x /etc/tcp.smtp.cdb \
-c "$MAXSMTPD" \
-u "$QMAILDUID" \
-g "$NOFILESGID" \
0 smtp /usr/local/bin/rblsmtpd \
-r sbl-xbl.spamhaus.org \
/usr/local/bin/relay-ctrl-check \
/var/qmail/bin/qmail-smtpd /var/qmail/bin/auth-smtp /bin/true 2>&1
===============================================
kernel-2.6.11-1.14_FC3
iptables-1.2.11-3.1.FC3
/etc/sysconfig/iptables
===============================================
# Generated by iptables-save v1.2.9 on Fri Sep 10 16:32:36 2004
*filter
:FORWARD DROP [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p icmp -m limit --limit 5/sec -j ACCEPT
# http
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -m limit --limit 2000/sec --limit-burst 2000 -j ACCEPT
-A OUTPUT -p icmp -m limit --limit 5/sec -j ACCEPT
-A OUTPUT -p icmp -j DROP
-A INPUT -p udp -m udp --dport 80 -j ACCEPT
# webmin
-A INPUT -p tcp -m tcp --dport 31585 -j ACCEPT
# webmin
-A INPUT -p udp -m udp --dport 31585 -j ACCEPT
-A INPUT -p udp -m udp --dport 443 -j ACCEPT
# https
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 22 -j ACCEPT
# smtp
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p udp -m udp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 25 -j ACCEPT
-A INPUT -p udp -m udp --sport 25 -j ACCEPT
# pop
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p udp -m udp --dport 110 -j ACCEPT
# nameserver
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
# imap
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p udp -m udp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p udp -m udp --dport 993 -j ACCEPT
# localhost
-A INPUT -s 127.0.0.1 -j ACCEPT
# https
-A INPUT -p tcp -m tcp --dport 444 -j ACCEPT
# https
-A INPUT -p udp -m udp --dport 444 -j ACCEPT
# 2022
-A INPUT -p tcp -m tcp -s 69.44.61.119 --dport 2022 -j ACCEPT
# 2022
-A INPUT -p udp -m udp -s 69.44.61.119 --dport 2022 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 447 -j ACCEPT
# https
-A INPUT -p udp -m udp --dport 447 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2525 -j ACCEPT
-A INPUT -p udp -m udp --dport 2525 -j ACCEPT
# FTP
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
# FTP-DATA
-A INPUT -p udp -m udp --dport 21 -j ACCEPT
-A INPUT -p udp -m udp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p icmp -j DROP
# all else
-A INPUT -p udp -m udp -j REJECT
-A INPUT -p tcp -m tcp -j REJECT
COMMIT
# Completed on Fri Sep 10 16:32:36 2004
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
===================================================
Any help is appreciated.
Thanks,
Russ
