1

Topic: cannot send email via roundcube when iptables are running

==== Required information ====
- iRedMail version: 0.8.7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: Ubuntu 14.04 LTS (trusty)
- Related log if you're reporting an issue:
====

I installed iRedMail on fresh ubuntu installation. That is VPS server. Configured domain and emails via web. iRedAdmin is working fine however there is and issue with RoundCube.

I can access roundcube from client webbrowser and see inbox/outbox however I cant send and receive email.

in /var/log/mail.err I get following message:
Aug 22 05:34:02 ***** roundcube: SMTP Error: SMTP error: Failed to add recipient '******@gmail.com' in /usr/share/apache2/roundcubemail-1.0.1/program/lib/Roundcube/rcube.php on line 1504 (POST /mail/?_task=mail&_unlock=loading1408700093446&_lang=pl?_task=mail&_action=send)

I've also noticed two strange behaviours.
1. When I run 'sudo iptables -F' it blocks my access and server does not respond - can anyone explain why? I was convinced that this is actually disabling any firewall rules and allows open access to the server. Only restart from HyperVM console helps here after that previous iptables rules loads and I can access server again.
2. When I run 'sudo service iptables stop' - this magically makes roundcube working fine and I can send and recieve emails.

here is /etc/default/iptables which is a standard one. I only changed SSH port from 22 to another one I use.

#---------------------------------------------------------------------
# This file is part of iRedMail, which is an open source mail server
# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.
#
# iRedMail is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# iRedMail is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.
#---------------------------------------------------------------------

#
# Sample iptables rules. It should be localted at:
#   /etc/sysconfig/iptables
#
# Shipped within iRedMail project:
#   * http://iRedMail.googlecode.com/
#

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Keep state.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# http/https, smtp/smtps, pop3/pop3s, imap/imaps, ssh
-A INPUT -p tcp -m multiport --dport 80,443,25,465,110,995,143,993,587,465,60222 -j ACCEPT

# Loop device.
-A INPUT -i lo -j ACCEPT

# Allow PING from remote hosts.
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# ejabberd
#-A INPUT -p tcp -m multiport --dport 5222,5223,5280 -j ACCEPT

# http/https
#-A INPUT -p tcp -m multiport --dport 80,443 -j ACCEPT

# smtp/smtps
#-A INPUT -p tcp -m multiport --dport 25,465 -j ACCEPT

# pop3/pop3s
#-A INPUT -p tcp -m multiport --dport 110,995 -j ACCEPT

# imap/imaps
#-A INPUT -p tcp -m multiport --dport 143,993 -j ACCEPT

# ldap/ldaps
#-A INPUT -p tcp -m multiport --dport 389,636 -j ACCEPT

# ftp.
#-A INPUT -p tcp -m multiport --dport 21,20 -j ACCEPT

# ssh
#-A INPUT -p tcp --dport 22 -j ACCEPT

COMMIT

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: cannot send email via roundcube when iptables are running

Additionally here is what I have in /var/log/mail.log

Aug 22 05:50:05 ******* postfix/smtpd[2275]: connect from localhost.localdomain[127.0.0.1]
Aug 22 05:51:06 ******* postfix/smtpd[2275]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 450 4.1.2 <*******@gmial.com>: Recipient address rejected: Domain not found; from=<info@mydomain.com> to=<*******@gmial.com> proto=ESMTP helo=<*******.pl>
Aug 22 05:51:06 ******* roundcube: SMTP Error: SMTP error: Failed to add recipient '*******@gmial.com' in /usr/share/apache2/roundcubemail-1.0.1/program/lib/Roundcube/rcube.php on line 1504 (POST /mail/?_task=mail&_unlock=loading1408701117636&_lang=pl?_task=mail&_action=send)
Aug 22 05:51:06 ******* postfix/smtpd[2275]: disconnect from localhost.localdomain[127.0.0.1]
Aug 22 05:51:33 ******* postfix/smtpd[2285]: connect from unknown[15.240.0.71]

3

Re: cannot send email via roundcube when iptables are running

bluszczy wrote:

Aug 22 05:51:06 ******* postfix/smtpd[2275]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 450 4.1.2 <*******@gmial.com>: Recipient address rejected: Domain not found; from=<info@mydomain.com> to=<*******@gmial.com> proto=ESMTP helo=<*******.pl>

It says recipient domain (gmial.com) not found. Is it supposed to be 'gmail.com', or gmial.com? Typo? If it is 'gmail.com', please make sure you're using correct DNS server in both /etc/resolv.conf and /var/spool/postfix/etc/resolv.conf.

bluszczy wrote:

1. When I run 'sudo iptables -F' it blocks my access and server does not respond - can anyone explain why? I was convinced that this is actually disabling any firewall rules and allows open access to the server. Only restart from HyperVM console helps here after that previous iptables rules loads and I can access server again.

"iptables -F' doesn't clear/flush ALL rules, please use "/etc/init.d/iptables stop" instead.

4

Re: cannot send email via roundcube when iptables are running

Thank you for help.

Sorry, that was a TYPO.

THis is what I have in both resolv.conf files:

nameserver 91.228.199.111
nameserver 8.8.8.8

If I am not mistaken somethign must be with iptables. When I am stopping iptables service emails works ok - I can send and recieve. After reboot whern iptables are being loaded it stops working and I cant send/recieve emails.

Any other ideas?

5

Re: cannot send email via roundcube when iptables are running

Check iptables rule file: /etc/default/iptables. Any unwanted rule?

6

Re: cannot send email via roundcube when iptables are running

ZhangHuangbin wrote:

Check iptables rule file: /etc/default/iptables. Any unwanted rule?

I pasted my iptables in few posts back. It is actually taken from iredmail installation. I am not very familiar with iptables rules so this is why I decided to take existing file.

this is what iptables -L returns:

Chain INPUT (policy DROP)
target     prot opt source               destination
fail2ban-postfix  tcp  --  anywhere             anywhere             multiport dports http,https,smtp,submission,pop3,pop3s,imap2,imaps,sieve
fail2ban-dovecot  tcp  --  anywhere             anywhere             multiport dports http,https,smtp,submission,pop3,pop3s,imap2,imaps,sieve
fail2ban-roundcube  tcp  --  anywhere             anywhere             multiport dports http,https,smtp,submission,pop3,pop3s,imap2,imaps,sieve
fail2ban-ssh  tcp  --  anywhere             anywhere             tcp dpt:22
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             multiport dports http,https,smtp,urd,pop3,pop3s,imap2,imaps,submission,urd,22
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-dovecot (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-postfix (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-roundcube (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

7

Re: cannot send email via roundcube when iptables are running

Strange thing... I can see in ipconfig -L some other Chains defined that does not exists in /etc/default/iptables. How come?
Is there any other location that iptables read and applies another configuration file I expect?

Thank you

8 (edited by tbogdan 2014-08-27 15:12:35)

Re: cannot send email via roundcube when iptables are running

iptables -F do clear all rules from your chains,

-F, --flush [chain]
Flush the selected chain (all the chains in the table if none is given).  This is equivalent to deleting all the rules one by one.

but your default chain policy is drop.

--- cut ---
this is what iptables -L returns:

Chain INPUT (policy DROP)
--- cut ---

If a chain have DROP policy default, that mean all connections will be droped so your rules in that chain will be with ACCEPT to allow some trafic.


The other rules you see there are from fail2ban app , fail2ban can read from logs and follow some rules you make to push a line in your iptables.

(Example) if fail2ban read from dovecot auth logs and see 3 failed logins in 1 min for example will push in your firewall: iptables -A INPUT -s ip-failed-login -j DROP
Search on google fail2ban for more info.

type:
iptables -L -n -v

... and paste here so we can help you if needed