Postfix bloqueado pelo firewall

Question

Eu configurei o Postfix no Ubuntu Server 16.04 como sistema de satélite que apenas escuta o host local e envia e-mails de saída para um servidor de retransmissão (via TLS na porta 465 e autenticação de senha). Tudo funciona (eu posso enviar e-mails) se eu não usar o firewall (iptables), mas assim que eu ativar o firewall, o envio de e-mails expirará.

Não consigo encontrar o que alterar, sugestões são bem-vindas.

Aqui estão minhas configurações:

Postfix main.cf

readme_directory = no
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
sender_canonical_maps = hash:/etc/postfix/generic 
smtp_generic_maps = hash:/etc/postfix/generic
smtpd_sasl_auth_enable = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtpd_sasl_path = smtpd
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_mechanism_filter = login
smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt 
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated     defer_unauth_destination
myhostname = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = example.com, $myhostname, localhost
relayhost = [smtps.relay.server]:465
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = all

iptables.rules

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
#loop back
-A INPUT  -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT  -s 127.0.0.0/8 -j DROP
#APT
-A OUTPUT -p tcp --dport 80 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp --dport 53 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT  -p tcp --sport 80 --dport 32768:61000 -m state --state ESTABLISHED     -j ACCEPT
-A INPUT  -p udp --sport 53 --dport 32768:61000 -m state --state ESTABLISHED     -j ACCEPT 
#MAIL
-A INPUT  -p tcp --dport 465 -j ACCEPT
-A OUTPUT -p tcp --sport 465 -j ACCEPT
-A INPUT  -p tcp --dport 587 -j ACCEPT
-A OUTPUT -p tcp --sport 587 -j ACCEPT
-A INPUT  -p tcp --dport 25  -j ACCEPT
-A OUTPUT -p tcp --sport 25  -j ACCEPT
COMMIT

    

Answer 1

Houve um erro nas regras do iptables. O destino e as portas de origem foram misturados. As regras de trabalho são:

iptables.rules:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
#loop back
-A INPUT  -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT  -s 127.0.0.0/8 -j DROP
#APT
-A OUTPUT -p tcp --dport 80 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp --dport 53 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT  -p tcp --sport 80 --dport 32768:61000 -m state --state ESTABLISHED     -j ACCEPT
-A INPUT  -p udp --sport 53 --dport 32768:61000 -m state --state ESTABLISHED     -j ACCEPT 
#MAIL
-A INPUT  -p tcp --sport 465 -j ACCEPT
-A OUTPUT -p tcp --dport 465 -j ACCEPT
#below not required in my use case
#-A INPUT  -p tcp --sport 587 -j ACCEPT
#-A OUTPUT -p tcp --dport 587 -j ACCEPT
#-A INPUT  -p tcp --sport 25  -j ACCEPT
#-A OUTPUT -p tcp --dport 25  -j ACCEPT
COMMIT