{"id":1107,"date":"2020-07-08T23:19:07","date_gmt":"2020-07-08T23:19:07","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=1107"},"modified":"2022-10-21T11:25:05","modified_gmt":"2022-10-21T11:25:05","slug":"how-to-setup-smtp-port-redirect-with-iptables-and-nat","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-setup-smtp-port-redirect-with-iptables-and-nat\/","title":{"rendered":"How to setup SMTP port redirect with IPTABLES and NAT"},"content":{"rendered":"

RedHat\/Centos<\/span><\/strong><\/p>\n

Okay its really easy to do. You will need to add the following in \/etc\/sysctl.conf
\nNote: these are kernel parameter changes<\/strong><\/p>\n

\n
\n
1.<\/span>vi \/etc\/sysctl.conf add the following lines<\/div>\n<\/div>\n<\/div>\n

kernel.sysrq = 1<\/p>\n

net.ipv4.tcp_syncookies=1<\/p>\n

net\/ipv4\/ip_forward=1 (important)<\/strong><\/p>\n

net.ipv4.conf.all.route_localnet=<\/span>1<\/span> (<\/span>important)<\/span><\/strong><\/p>\n

net.ipv4.conf.default.send_redirects = 0<\/p>\n

net.ipv4.conf.all.send_redirects = 0<\/p>\n

.<\/span><\/span><\/p>\n

\n
\n
2.<\/span>Save the file and run<\/div>\n
\n
\n
\u2022<\/span> <\/span>Sysctl -p (this will load the new kernel parameters)<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
3.<\/span>Now you if you already have iptables running you want to save the running config and add the new redirect rules<\/div>\n
\n
\n
\u2022<\/span> <\/span>Iptables-save > iptables.back<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
4.<\/span>Now you want to edit the iptables.back file and add the redirect rules<\/div>\n
\n
\n
\u2022<\/span> <\/span>vi iptables.back<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

It will probably look something like the rules below.<\/p>\n

EXAMPLE<\/strong><\/span><\/p>\n

# Generated by iptables-save v1.2.8 on Thu July 6 18:50:55 2020<\/p>\n

*filter<\/p>\n

:INPUT ACCEPT [0:0]<\/p>\n

:FORWARD ACCEPT [0:0]<\/p>\n

:OUTPUT ACCEPT [2211:2804881]<\/p>\n

:RH-Firewall-1-INPUT – [0:0]<\/p>\n

-A INPUT -j RH-Firewall-1-INPUT<\/p>\n

-A FORWARD -j RH-Firewall-1-INPUT<\/p>\n

-A RH-Firewall-1-INPUT -i lo -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p icmp -m icmp –icmp-type 255 -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p esp -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p ah -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 1025-m state –state NEW -j ACCEPT (make sure to have open)<\/strong><\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 443 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 8443 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 25 -m state –state NEW -j ACCEPT (make sure to have open)<\/strong><\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 80 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 21 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 22 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 106 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 143 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 465 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 993 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 995 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 8222 -m state –state NEW -j ACCEPT<\/p>\n

-A RH-Firewall-1-INPUT -j REJECT –reject-with icmp-host-prohibited<\/p>\n

COMMIT<\/p>\n

#<\/span>ADD this section with another Commit<\/span> like below<\/span><\/strong><\/p>\n

# Completed on Thu July 6 18:50:55 2020<\/em><\/p>\n

# Generated by iptables-save v1.2.8 on Thu July 6 18:50:55 2020<\/em><\/p>\n

*nat<\/em><\/p>\n

:PREROUTING ACCEPT [388:45962]<\/em><\/p>\n

:POSTROUTING ACCEPT [25:11595]<\/em><\/p>\n

:OUTPUT ACCEPT [25:11595]<\/em><\/p>\n

-A PREROUTING -p tcp -m tcp –dport 1025 -j REDIRECT –to-ports 25<\/em><\/p>\n

COMMIT<\/em><\/p>\n

# Completed on Thu July 6 18:50:55 2020<\/em><\/p>\n

.<\/span><\/span><\/p>\n

\n
\n
\u2022<\/span> <\/span>Save the file<\/div>\n

.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n
5.<\/span>Next you want to reload the new config<\/div>\n
\n
\n
\u2022<\/span> <\/span>Iptables-restore < iptables.back<\/em><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
6.<\/span>Now you should be able see the new rules and test<\/div>\n
\n
\n
\u2022<\/span> <\/span>Iptables -L -n -t nat<\/em> (should show the rules)<\/strong><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

[root@nick ~]# iptables -L -n | grep 1025<\/em><\/p>\n

ACCEPT tcp — 0.0.0.0\/0 0.0.0.0\/0 tcp dpt:1025 state NEW<\/em><\/p>\n

[root@nick ~]# iptables -L -n -t nat| grep 1025<\/em><\/p>\n

REDIRECT tcp — 0.0.0.0\/0 0.0.0.0\/0 tcp dpt:1025 redir ports 25<\/em><\/p>\n

.<\/span><\/span><\/p>\n

Note:<\/em><\/strong><\/p>\n

You will need to run telnet from outside the host as you cant NAT to localhost locally. \ud83d\ude42<\/em><\/strong><\/p>\n

.<\/span><\/span><\/em><\/p>\n

[root@nick1 ~]# telnet 192.168.86.111 1025<\/em><\/p>\n

Trying 192.168.86.111…<\/em><\/p>\n

Connected to localhost.<\/em><\/p>\n

Escape character is ‘^]’.<\/em><\/p>\n

220 nick.ansible.com ESMTP Postfix<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

RedHat\/Centos Okay its really easy to do. You will need to add the following in \/etc\/sysctl.conf Note: these are kernel parameter changes 1.vi \/etc\/sysctl.conf add the following lines kernel.sysrq = 1 net.ipv4.tcp_syncookies=1 net\/ipv4\/ip_forward=1 (important) net.ipv4.conf.all.route_localnet=1 (important) net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.send_redirects = 0 . 2.Save the file and run \u2022 Sysctl -p (this will load the new kernel parameters) 3.Now you ifRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58,138,60,124,131],"tags":[],"class_list":["post-1107","post","type-post","status-publish","format-standard","hentry","category-centos","category-linux","category-mailstuff","category-network-stuff","category-security"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=1107"}],"version-history":[{"count":4,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1107\/revisions"}],"predecessor-version":[{"id":1592,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1107\/revisions\/1592"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=1107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=1107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=1107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}