Firewall rule to only allow Postfix to send email through SMTP on port 25

Question

As suggested in How do you detect a spambot on your network? how can I setup firewall rule to allow only Postifx to send emails using SMTP on port 25 and disallow all other applications to send on port 25?

I want to control email server of single machine.

Something related is being talked here but not sure of the Iptables rules.

Michael Hampton · Accepted Answer · 2015-12-02T11:30:38.287

5

Do two things:

Run Postfix under its own user account. It should already be doing so, on any sane system.
Set an iptables rule with a uid match for that account, which blocks outgoing traffic to destination port 25 not from that user.

For example: Here we assume the username is postfix, though it may be something different on your system.
```
iptables -I OUTPUT -m owner ! --uid-owner postfix -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp-admin-prohibited
ip6tables -I OUTPUT -m owner ! --uid-owner postfix -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp6-adm-prohibited
```
Note that when you save the rule, the user name will be converted to a numeric uid.

edited Dec 02 '15 at 11:30

answered Dec 02 '15 at 11:23

Michael Hampton

237,123
42
477
940

Thanks but how can I check if this rule is indeed working. How can I send email directly to port 25? – user5858 Dec 02 '15 at 11:40
If the rule is in place, then not even root can make an outgoing connection to port 25. e.g. `telnet smtp.googlemail.com 25` will fail. – Michael Hampton Dec 02 '15 at 12:53
Indeed it's not working from root account but working when logged in as postfix account. – user5858 Dec 02 '15 at 13:54
@MichaelHampton can we specify multiple users with above posted command, by repeating it with other --uid--owner? – Miloš Đakonović Jun 28 '16 at 13:18

score 0 · Answer 2 · answered Dec 02 '15 at 11:48

0

@MichaelHampton's answer is excellent if you are only trying to regulate the behaviour of a single linux system. The title of your linked serverfault page refers to a network. It's not clear from your post if that is part of what you need to do.

You could approach this by limiting sending to port 25 outside of your network so that it's only accessible by a single IP in that network. That IP could be associated with a locked down system (possibly virtual or containerised), that only runs the mail relay. If on the other hand you have untrusted processes which can send from that IP, then go back to @MichaelHampton's answer for how to lock that down.

answered Dec 02 '15 at 11:48

mc0e

5,786
17
31

I've updated it, it's a Ubuntu VPS. – user5858 Dec 02 '15 at 11:50
That's still not clear. What's the role of that ubuntu VPS? Are you trying to control the behaviour of a single machine, or regulate traffic from a network? – mc0e Dec 02 '15 at 11:55
I want to control behaviour of single machine with Postfix server. – user5858 Dec 02 '15 at 12:23
Then @MichaelHampton's answer is the one you want. I'll leave this one here though for the sake of people looking for answers to variants on your question. – mc0e Dec 02 '15 at 13:35

Firewall rule to only allow Postfix to send email through SMTP on port 25

2 Answers2

Linked