1 (edited by rik 2021-07-13 21:52:15)

Topic: Firewall issue

I've have a problem with my server which is blocking ports i'm not telling it to block. I've cleared the iptables rules and turned of ufw but it still blocks a port. Is there a new kind of firewall iredmail is using i'm missing?

nft was the firewall I was missing.


==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version: 1.4.0 MARIADB edition
- Deployed with iRedMail Easy
- Linux/BSD distribution name and version: ubuntu 20.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MARIADB
- Web server (Apache or Nginx):Nginx
====

2

Re: Firewall issue

Which port is blocked?

some isp block ports from outside, so it might not be related to your configuration at all, or that the port you are looking for is only listening to localhost and not public ip.

without any further information, this can't be solved

3 (edited by rik 2021-07-13 05:45:09)

Re: Firewall issue

There are multiple blocked but I only care about 9090 atm. It seems that only the ones related to iredmail are open(22,25,80,110,143,443,587,993,995) and everything else is close leading me to believe its a firewall blocking them. As far as I can see my host (OVH) doesn't block any ports i'm trying to use. I've already made iptables accept everything and turned off/added the ports to ufw but those ain't the onces that block them.

4

Re: Firewall issue

Can you share the IPTABLES and UFW rules for that port that you have set? I would also check Fail2Ban to make sure its not blocking there.

5

Re: Firewall issue

iptables:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

ufw (when enabled)

Status: active

To                         Action      From
--                         ------      ----
9090                       ALLOW       Anywhere
9091                       ALLOW       Anywhere
22                         ALLOW       Anywhere
9090 (v6)                  ALLOW       Anywhere (v6)
9091 (v6)                  ALLOW       Anywhere (v6)
22 (v6)                    ALLOW       Anywhere (v6)

After looking into fail2ban configurations i've found a guy mentioning that most distros went to nft as default firewall.. After flushing those rules it works. So I guess the answer to my question was nft.

6

Re: Firewall issue

Do you have /etc/default/iptables and it blocks port 8080 by default.
or /etc/nftables.conf?

----

Buy me a cup of coffee ($5) to support iRedMail:

buy me a cup of coffee