FALHA NO ENVIO DE E-MAILS

diogospace
(usa Debian)

Enviado em 14/05/2015 - 12:04h

Galera boa tarde.
Estou com um problema que não é constante.
As vezes os e-mails que saem pelo Outlook estão falhando, só que se limpo as regras do firewall com iptables -F e reenvio o e-mail "o danado sai".

preciso do auxilio de alguém por que ja tentei de tudo.

Segue minhas regras.

#!/bin/
# Script de Regras do Iptables
# Acionado por /etc/init.d/firewall start
# Criado pela Iccone Informatica (Sem data)
#ETH0 = EXTERNO - ETH1 = INTERNO

#### Bloqueio de Acesso externo ao Apache Web #####
iptables -A INPUT -p tcp -d IPEXTERNO --dport 80 -j DROP
iptables -A INPUT -p tcp -s IPEXTERNO --dport 80 -j DROP
#### Fim do Bloqueio ao Apache Web #####

					###### Inicio das Regras normais do Firewall #####
#*filter

iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A INPUT -i tun0 -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --sport 53 -j ACCEPT #DNS
iptables -t filter -A INPUT -p udp -m udp --dport 53 -j ACCEPT 
iptables -t filter -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT #http
iptables -t filter -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
iptables -t filter -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT #ssl
iptables -t filter -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
iptables -t filter -A INPUT -p tcp -m tcp --sport 110 -j ACCEPT #pop
iptables -t filter -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT 
iptables -t filter -A INPUT -p tcp -m tcp --sport 25 -j ACCEPT #smtp
iptables -t filter -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT 
iptables -t filter -A INPUT -p tcp -m tcp --sport 587 -j ACCEPT
iptables -t filter -A INPUT -p tcp -m tcp --dport 587 -j ACCEPT 

iptables -t filter -A INPUT -p tcp -m tcp --sport 22 -j ACCEPT #ssh
iptables -t filter -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 

iptables -t filter -A INPUT -p tcp -m tcp --sport 21 -j ACCEPT #ftp
iptables -t filter -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT

iptables -t filter -A INPUT -p tcp -m tcp --sport 5900 -j ACCEPT #VNC
iptables -t filter -A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT

iptables -t filter -A INPUT -p tcp -m tcp --sport 8245 -j ACCEPT #NO-IP
iptables -t filter -A INPUT -p tcp -m tcp --dport 8245 -j ACCEPT 

iptables -t filter -A INPUT -p tcp -m tcp --sport 10050 -j ACCEPT #Zabbix
iptables -t filter -A INPUT -p tcp -m tcp --dport 10050 -j ACCEPT 

iptables -t filter -A INPUT -p tcp -m tcp --sport 8081 -j ACCEPT #sunproxyadmin
iptables -t filter -A INPUT -p tcp -m tcp --dport 8081 -j ACCEPT

iptables -t filter -A INPUT -p tcp -m tcp --sport 8082 -j ACCEPT #us-cli - Utilistor 
iptables -t filter -A INPUT -p tcp -m tcp --dport 8082 -j ACCEPT

iptables -t filter -A INPUT -p tcp -m tcp --sport 21000 -j ACCEPT #irtrans - IRTrans Control
iptables -t filter -A INPUT -p tcp -m tcp --dport 21000 -j ACCEPT

iptables -t filter -A INPUT -p tcp -m tcp --sport 8080 -j ACCEPT #http-alt - HTTP Alternate 
iptables -t filter -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT 

iptables -t filter -A INPUT -p tcp -m tcp --sport 2082 -j ACCEPT #infowave - Infowave Mobility Server
iptables -t filter -A INPUT -p tcp -m tcp --dport 2082 -j ACCEPT 

iptables -t filter -A INPUT -p tcp -m tcp --sport 1194 -j ACCEPT #openvpn - OpenVPN
iptables -t filter -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT

iptables -t filter -A INPUT -p tcp -m tcp --sport 809 -j ACCEPT #SPTRANS
iptables -t filter -A INPUT -p tcp -m tcp --dport 809 -j ACCEPT 

iptables -t filter -A INPUT -i eth1 -p udp -m udp --sport 137 -j ACCEPT #netbios-ns - NETBIOS Name Service
iptables -t filter -A INPUT -i eth1 -p udp -m udp --dport 137 -j ACCEPT
iptables -t filter -A INPUT -i eth1 -p udp -m tcp --sport 137 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m tcp --dport 137 -j ACCEPT
iptables -t filter -A INPUT -i eth1 -p udp -m udp --sport 139 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --dport 139 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --sport 139 -j ACCEPT
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 139 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --sport 138 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --dport 138 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --sport 138 -j ACCEPT
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 138 -j ACCEPT 

iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --sport 22000 -j ACCEPT #snapenetio - SNAPenetIO - #alterado para eth1 "verificar se houver erros"

iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --sport 135 -j ACCEPT #epmap - DCE endpoint resolution
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 135 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --sport 135 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --dport 135 -j ACCEPT

iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --sport 445 -j ACCEPT #microsoft-ds - Microsoft-DS
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 445 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --sport 445 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p udp -m udp --dport 445 -j ACCEPT 

iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 3128 -j ACCEPT #Redirecionaento squid

iptables -t filter -A INPUT -s 127.0.0.1 -d 127.0.0.1 -p udp -j ACCEPT 
iptables -t filter -A INPUT -s 127.0.0.1 -d 127.0.0.1 -p tcp -j ACCEPT
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT #http
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --sport 81 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p tcp -m tcp --dport 81 -j ACCEPT
iptables -t filter -A INPUT -p tcp -m tcp --dport 7531 -j ACCEPT 
iptables -t filter -A INPUT -i eth1 -p icmp -j ACCEPT
iptables -t filter -A INPUT -p tcp -m tcp --sport 37 -j ACCEPT #Relógio (time)
iptables -t filter -A INPUT -p tcp -m multiport -s 0/0 -d 192.168.11.254 --dport 3050,3051 -j ACCEPT #Firebird
iptables -t filter -A OUTPUT -p tcp -m multiport -s 0/0 -d 192.168.11.254 --sport 3050,3051 -j ACCEPT
iptables -t filter -A INPUT -p tcp -m multiport -s 0/0 -d 192.168.11.254 --dport 3000,3001 -j ACCEPT #ntop
iptables -t filter -A OUTPUT -p tcp -m multiport -s 0/0 -d 192.168.11.254 --sport 3000,3001 -j ACCEPT

iptables -A FORWARD -p tcp --dport 25 -j ACCEPT #smtp
iptables -A FORWARD -p tcp --dport 587 -j ACCEPT
iptables -t filter -A INPUT -p gre -j ACCEPT
iptables -t filter -A INPUT -p icmp -j ACCEPT

#iptables -t filter -A INPUT -m limit --limit 4/min -j LOG --log-prefix "INP_DROP -- DENY Policy " --log-level 6 
iptables -t filter -A INPUT -j DROP

					#### Definição de Portas por IP ####
#Diogo
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 443 -j ACCEPT #ssl
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 443 -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 25 -j ACCEPT #smtp
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 25 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 587 -j ACCEPT #smtp
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 587 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 110 -j ACCEPT #pop
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 110 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 123 -j ACCEPT #NTP
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 123 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 8080 -j ACCEPT #http
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 8080 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 802 -j ACCEPT #Swith 24 portas
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 802 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 809 -j ACCEPT #sptrans
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 809 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 3000 -j ACCEPT 
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 3000 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 3001 -j ACCEPT
iptables -t filter -A FORWARD -s 192.168.11.48 -p tcp -m tcp --dport 3001 -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 3002 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --dport 3002 -j ACCEPT 
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --sport 2082 -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.11.48 -p tcp -m tcp --dport 2082 -j ACCEPT
iptables -t filter -A INPUT -p tcp -m multiport -s 0/0 -d 192.168.11.48 --dport 1433,1434 -j ACCEPT #SQL
iptables -t filter -A OUTPUT -p tcp -m multiport -s 0/0 -d 192.168.11.48 --sport 1433,1434 -j ACCEPT

					#### Fim da Definição de Portas por IP ####
							
					#### Definição de Portas Gerais ####
							
iptables -t filter -A FORWARD -p tcp -m tcp --sport 1234 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --dport 1234 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 5900 -j ACCEPT #vnc-server - VNC Server
iptables -t filter -A FORWARD -p tcp -m tcp --dport 5900 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 443 -j ACCEPT #ssl
iptables -t filter -A FORWARD -p tcp -m tcp --dport 443 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 123 -j ACCEPT #NTP
iptables -t filter -A FORWARD -p tcp -m tcp --dport 123 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 8080 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --dport 8080 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 809 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --dport 809 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 3000 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --dport 3000 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --sport 3002 -j ACCEPT 
iptables -t filter -A FORWARD -p tcp -m tcp --dport 3002 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --sport 53 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --dport 53 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --sport 587 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --dport 587 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 25 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --dport 25 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 110 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --dport 110 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 123 -j ACCEPT 
iptables -t filter -A FORWARD -p udp -m udp --dport 123 -j ACCEPT 

### Portas DVR Intelbras ###
iptables -t filter -A FORWARD -p tcp -m tcp --dport 37777 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -m tcp --sport 37777 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -m tcp --dport 7070 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -m tcp --sport 7070 -j ACCEPT
### Fim das Portas do DVR Intelbras ###

### Portas ATA ###
iptables -t filter -A FORWARD -p udp -m udp --dport 5060 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 5060 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --dport 5090 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 5090 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --dport 5000 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 5000 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --dport 4515 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 4515 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --dport 4516 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --sport 4516 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m multiport --dport 9000:9049 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m multiport --dport 5480:5489 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m multiport --dport 7000:7499 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m multiport --dport 23000:23999 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m multiport --dport 40000:40999 -j ACCEPT
### Fim das Portas do ATA ###

### Portas CPS MOBILE ###
iptables -t filter -A FORWARD -p tcp -m tcp --dport 2021 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -m tcp --sport 2021 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -m tcp --dport 8080 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -m tcp --sport 8080 -j ACCEPT
### Fim das Portas CPS MOBILE ###


## Bloqueio Redes Sociais
#  Apenas para a lista da linha abaixo será permitido o acesso!
for t in `cat /Administrativo/Internet/access.dat` ; do
#  Bloqueia o acesso a todos exceto os da lista (!)
iptables -I FORWARD -i eth1 -m string --algo bm --string "facebook.com" -j DROP ! -s $t
iptables -I FORWARD -i eth1 -m string --algo bm --string "twitter.com" -j DROP ! -s $t
done
## Fim do Bloqueio Redes Sociais

iptables -t filter -A FORWARD -p udp -m multiport --dport 2101:2240 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m multiport --sport 2121:2240 -j ACCEPT
### Fim das Portas SUPORTE GRV X  ###

					#### Fim da Definição de Portas Gerais ####
						
#iptables -t filter -A FORWARD -m limit --limit 4/min -j LOG --log-prefix "FWD_DROP -- DENY Policy " --log-level 6 
iptables -t filter -A FORWARD -j DROP

#*mangle

#*nat

iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 
iptables -t nat -A POSTROUTING -s 192.168.11.0/255.255.255.0 -o eth0 -j MASQUERADE 

### Encaminhamento portas DVR ###
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7070 -j DNAT --to-destination 192.168.11.33:7070 
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 37777 -j DNAT --to-destination 192.168.11.33:37777
### Fim do Encaminhamento portas DVR ###

### Encaminhamento portas CPS MOVEL ###
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.11.87:8080
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2021 -j DNAT --to-destination 192.168.11.87:2021
### Fim do Encaminhamento portas CPS MOVEL ###

### Encaminhamento portas ATA ###
#EXTERNO
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 5060 -j DNAT --to-destination 192.168.11.48:5060 
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 5090 -j DNAT --to-destination 192.168.11.48:5090
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 4515 -j DNAT --to-destination 192.168.11.48:4515
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 4516 -j DNAT --to-destination 192.168.11.48:4516
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 5000 -j DNAT --to-destination 192.168.11.48:5000 
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 5090 -j DNAT --to-destination 192.168.11.48:5090
iptables -t nat -A PREROUTING -i eth1 -p udp -m multiport --dport 9000:9049 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth1 -p udp -m multiport --dport 5480:5489 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth1 -p udp -m multiport --dport 7000:7499 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth1 -p udp -m multiport --dport 23000:23999 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth1 -p udp -m multiport --dport 40000:40999 -j DNAT --to-dest 192.168.11.48
#INTERNO
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5060 -j DNAT --to-destination 192.168.11.48:5060
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5090 -j DNAT --to-destination 192.168.11.48:5090
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 4515 -j DNAT --to-destination 192.168.11.48:4515
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 4516 -j DNAT --to-destination 192.168.11.48:4516
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5000 -j DNAT --to-destination 192.168.11.48:5000
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5090 -j DNAT --to-destination 192.168.11.48:5090
iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dport 9000:9049 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dport 5480:5489 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dport 7000:7499 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dport 23000:23999 -j DNAT --to-dest 192.168.11.48
iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dport 40000:40999 -j DNAT --to-dest 192.168.11.48
### Fim do Encaminhamento portas ATA ###

#iptables -A INPUT -j LOG --log-level info --log-prefix "DROP:"
#iptables -A OUTPUT -j LOG --log-level info --log-prefix "DROP:"


					##### Fim do Firewall  #####

 

diogospace
(usa Debian)

Enviado em 20/05/2015 - 08:03h

alguém tem uma luz?

diogospace
(usa Debian)

Enviado em 27/05/2015 - 10:52h

thinomar
(usa Linux Mint)

Enviado em 27/05/2015 - 12:35h

Abra as portas:
-465 (SMTP)
-993 (IMAP)
-995 (POP3)
-110 (POP)

Pra FORWARD e, no caso de precisar liberar pro firewall server, pra INPUT também. Só dport já serve. Depois que abrir as portas, reiniciar seu script e testar, nos fale no que deu.
--
The flames warm my languid soul

diogospace
(usa Debian)

Enviado em 10/06/2015 - 14:10h

Olá amigo.
Tentei fazer o solicitado mais continua, depois verifiquei que ja está assim tanto para FW quanto para IPT

Fenix1978BR
(usa Ubuntu)

Enviado em 10/06/2015 - 14:11h

Seu provedor de email é da Locaweb ou é um outro provedor?

diogospace
(usa Debian)

Enviado em 10/06/2015 - 14:27h

é outro.
Mais agora enquanto respondia o de cima, vi algo.

iptables -t filter -A FORWARD -p udp -m udp --sport 587 -j ACCEPT
iptables -t filter -A FORWARD -p udp -m udp --dport 587 -j ACCEPT

a porta FW está como UPD não TCP.
Acabei de mudar e farei o Teste.

srssrs