iptables/ ufw problem with getting emails

Jabin

10/7/23, 11:29 AM

I have a very difficult problem that I can't seen to solve. I have an Ubuntu Server 20.04.5 LTS set up as a firewall/ router, so it has two interfaces. One internet connected and the other lan connected. I use iptables nat table and ufw to forward incoming allowed services to the relevant lan destinations. For a long time the rules below have worked to allow our isp to send our domain email to our email server:

before.rules
-A PREROUTING -i enp2s0 -s 196.44.176.11/32 -p tcp --dport 25 -j DNAT --to-destination 192.168.50.4:25
user.rules
-A ufw-user-forward -i enp2s0 -o enp1s0 -p tcp -d 192.168.50.4 --dport 25 -s 196.44.176.11/32 -j ACCEPT

recently we upgraded our internet service which entailed a new modem and a new public ip address. The isp then redirected the delivery of the mail to the new public ip. Since that time, we cannot receive email. Our mail server sees the connection from the isp and the logs show the starttls and that the ssl/ tls session is establish. It ends with

DATA
354 OK, send data, end with CRLF

but from there the email data never arrives and eventually it times out.

If I bypass the firewall and connect the modem directly with the mail server the email arrives correctly. All other forwarded services work properly. Even a branch office can connect and send us email in the same way and that works fine!

The only ufw logs I can find are:

[UFW AUDIT] IN=enp2s0 OUT=enp1s0 
MAC=00:1f:c6:e1:58:94:68:72:51:8b:36:2d:08:00 SRC=196.44.176.11
DST=192.168.50.4 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=18623 DF PROTO=TCP
SPT=38418 DPT=25 WINDOW=29200 RES=0x00 SYN URGP=0

Please could someone help

0 + 4

server

iptables

firewall

Jabin

10/7/23, 12:11 PM

Sorry made a mistake on the Ubuntu version: Ubuntu Linux 20.04.4 server LTS

Jabin

10/7/23, 2:35 PM

I cleared out the iptables (iptables -F). Did a complete restart, downloaded all the emails by bypassing the Ubuntu firewall and then reconnected the firewall. 'Miraculously', that seems to have sorted the problem for now.

Doug Smythies

10/7/23, 2:41 PM

I do not understand the `--dport 24` in your forward rule.

Jabin

10/10/23, 6:33 AM

I've edited details in my original post. Sorry for the confusion. According to apt-get upgrade everything is up to date. I believe that the difficulty I was having had to do with the backlog of mail in some way.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: iptables/ ufw problem with getting emails

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.