Postfix port forwarding

Help! (Home for newbies)
1

I see others have had the problem of Posfix sending outbound email due to port 25 being blocked by their ISP (as in my case).

My Virtualmin server is located on a network with a firewall in the router.

Currently I am able to connect to posfix from a remote IP, i.e.

telnet mail.example-domain.com 26
Trying xx.xxx.xxx.xxx…
Connected to mail.example-domain.com (xx.xxx.xxx.xxx).
Escape character is ‘^]’.
220 amazing.billyfire.net ESMTP Postfix

I am also able to send e-mail from Thunderbird and it ends up in a queue on the server.

var/log/maillog shows comments like:

Dec 31 11:50:43 billyfire postfix/smtp[12193]: connect to mx.west.cox.net[68.6.19.3]: No route to host (port 25)

So my conclusion is that the Postfix is not able to form a connection to the receiving server because it is trying to do so on port 25, which is blocked.

I did some research and a couple of sites: (http://www.go2linux.org/iptables-port-26-redirection-accept-email-on-another-port

and

http://rimuhosting.com/support/settingupemail.jsp?mta=postfix&t=blockingisp#blockingisp)

suggest adding the following rules to the IP table:

#Accept connections on ports 25, 26 and 110
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 26 -j ACCEPT
##Next redirect 26 to 25
iptables -A PREROUTING -t nat -p tcp --dport 26 -j REDIRECT --to-port 25

I tried this unsuccessfully and wondered if anyone had been able to implement successfully. What I am particularly confused by is why this would be PREROUTING. Surely it would be POSTROUTING to achieve what I want to do (i.e. redirect port 25 traffic to port 26).

Thanks.<br><br>Post edited by: martynw, at: 2008/12/31 13:27

2

I would suggest enabling the smtps service or the submission service, or both, in the Postfix master.cf, rather than using port forwarding. (Or, you could invent a whole new service on port 26, if you wanted.)

You do have to setup TLS in Postfix for smtps, of course…but that’s not too complicated, and having your passwords and mail encrypted in transit isn’t a bad thing.

What I am particularly confused by is why this would be PREROUTING. Surely it would be POSTROUTING to achieve what I want to do (i.e. redirect port 25 traffic to port 26).

No. It’s definitely PREROUTING. Why is just a matter of the way iptables hooks into the network stack (it has hooks into each of several stages of the routing process, and port forwarding, IP masquerading, etc. all have to happen in the PREROUTING stage).