How to block port 25 on OpenVPN ?

romedo

Hi everybody,

I just want to block port 25 or any other specific port on my OpenVPN server. It's running on CentOS and I have used "iptables" but it's not working; still users cand send email via port 25. Here it is:

iptables -A FORWARD -o eth0 -p tcp --dport 25 -j REJECT

Anyone can help me to figure this out ?

Regards,
Romedo

Mimiko

It's not OpenVPN matter, you should learn iptables basis.
Use iptables -A INPUT -i tun0 -p tcp --dport 25 -j REJECT

romedo

Mimiko wroteIt's not OpenVPN matter, you should learn iptables basis.
Use iptables -A INPUT -i tun0 -p tcp --dport 25 -j REJECT

Thank you Mimiko. Yes, I'm a newbie in Linux. The command has down on the server but problem is still present.

Could you please help me more ?

Regards,

romedo

Hi every body,

I have tested various configuration on "iptables" with no sccess :-(

Here is the list of my "iptables":

[root@open ~]# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
AS0_ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
AS0_ACCEPT all -- anywhere anywhere
AS0_IN_PRE all -- anywhere anywhere MARK match 0x2000000/0x2000000
AS0_ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
AS0_WEBACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
AS0_WEBACCEPT tcp -- anywhere anywhere state NEW tcp dpt:943
RH-Firewall-1-INPUT all -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp dpt:smtp
DROP tcp -- anywhere anywhere tcp dpt:smtp
REJECT tcp -- anywhere anywhere tcp dpt:smtp reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination
AS0_ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
AS0_IN_PRE all -- anywhere anywhere MARK match 0x2000000/0x2000000
AS0_OUT_S2C all -- anywhere anywhere
RH-Firewall-1-INPUT all -- anywhere anywhere
REJECT tcp -- anywhere anywhere tcp dpt:smtp reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
AS0_OUT_LOCAL all -- anywhere anywhere
REJECT tcp -- anywhere anywhere tcp dpt:smtp reject-with icmp-port-unreachable

Chain AS0_ACCEPT (4 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain AS0_IN (4 references)
target prot opt source destination
ACCEPT all -- anywhere 5.5.0.1
ACCEPT all -- anywhere 192.168.0.0/16
ACCEPT all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere 172.16.0.0/12
AS0_IN_POST all -- anywhere anywhere

Chain AS0_IN_POST (1 references)
target prot opt source destination
AS0_OUT all -- anywhere anywhere
DROP all -- anywhere anywhere

Chain AS0_IN_PRE (2 references)
target prot opt source destination
AS0_IN all -- anywhere 5.5.0.0/20
AS0_IN all -- anywhere 172.16.0.0/12
AS0_IN all -- anywhere 192.168.0.0/16
AS0_IN all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere anywhere

Chain AS0_OUT (2 references)
target prot opt source destination
DROP all -- anywhere anywhere

Chain AS0_OUT_LOCAL (1 references)
target prot opt source destination
DROP icmp -- anywhere anywhere icmp redirect
ACCEPT all -- anywhere anywhere

Chain AS0_OUT_S2C (1 references)
target prot opt source destination
AS0_OUT all -- anywhere anywhere

Chain AS0_WEBACCEPT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

and the list of interfaces:

[root@open ~]# ifconfig
as0t0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:5.5.0.1 P-t-P:5.5.0.1 Mask:255.255.240.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:197338 errors:0 dropped:0 overruns:0 frame:0
TX packets:229041 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:200
RX bytes:24444225 (23.3 MiB) TX bytes:175663874 (167.5 MiB)

eth0 Link encap:Ethernet HWaddr 00:0C:29:47:3D:1F
inet addr:x.x.x.x Bcast:x.x.x.x Mask:255.255.255.248
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:463677 errors:5 dropped:5 overruns:0 frame:0
TX packets:489364 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:225053422 (214.6 MiB) TX bytes:224380336 (213.9 MiB)
Interrupt:51 Base address:0x2000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:7126 errors:0 dropped:0 overruns:0 frame:0
TX packets:7126 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:8468986 (8.0 MiB) TX bytes:8468986 (8.0 MiB)

Still everyone can send email on port 25 :-( please someone help.

Mimiko

A little internet search:

iptables -A INPUT -p tcp --destination-port {PORT-NUMBER-HERE} -j DROP

romedo

Hey my friend,

I have used various configuration, none of them are working!!

It's very normal that firewall can not block port 25 with this command.

iptables -A INPUT -p tcp --destination-port {PORT-NUMBER-HERE} -j DROP

It means attend this rule to a chain named INPUT and when the protocol is TCP and destination port is 25, drop the packet.

So, when an OpenVPN tunnel is established, the firewall can not drop the packets inside the tunnel, so we have to add an extra parameter like interface [-i] to our command.

There is 3 interface in the output of "ifconfig" command:

eth0: Ethernet adapter
as0t0: UNSPEC (it seems it's the openvpn adapter)
lo: Local loopback

I have even added iptables rules with interface as0t0 and lo, but no success!! :-(

Anyone can help me ?

regards,
Romedo

romedo

Finally solved 😉

I have added three rules for each interface and chain:

iptables -A INPUT -i eth0 -p TCP --dport 25 -j DROP
iptables -A INPUT -i as0t0 -p TCP --dport 25 -j DROP
iptables -A INPUT -i lo -p TCP --dport 25 -j DROP

iptables -A FORWARD -i eth0 -p TCP --dport 25 -j DROP
iptables -A FORWARD -i as0t0 -p TCP --dport 25 -j DROP
iptables -A FORWARD -i lo -p TCP --dport 25 -j DROP

and the very important thing is to place these DROP rules at the first order. I mean above of other rules at each chain.

So I have downloaded "iptables" in /etc/sysconfig/ and opened with Notepad++, then changed the orders and replaced the new file. Finally restarted the "iptables" service.

Hopefully it helps same cases :-)

Mimiko

romedo, finally you done it yourself this little job. Congrats.

I don't use linux on basis, but on logical thought, ommiting -i option implies denying that port on all interfaces. Also adding rules after iptables was loaded in memory at startup, this rules are placed on top of chain. Adding denying port 25 to forward rules affect only accesing internet servers on port 25 thru your VPN tunnel by VPN clients, which you didn't state you whant to block too.

Using -i lo also will deny accessing to port 25 for local software, ie you will not be able from server to access the mail services on same server.

Bebop

romedo wrotestill users cand send email via port 25. Here it is:

Hi everyone 8-) I see you didn't consider blocking output yet :shock:

Users can be prevented from sending port 25 mail with just one simple command:

/sbin/iptables -A OUTPUT -p tcp --dport 25 -j DROP

Also, romdeo, good to see you have been trying to figure it all out.... the most effective way to manage IPTABLES is with a bash script. Check out my example page and borrow some tips from there: https://forums.openvpn.net/topic7722.html