Не приходит почта извне.

[shelk]

Люди добрые помогите, проблема такая: не приходить почта из вне, внутри бегает без проблем, во вне тоже выходит.
Почта стоит за шлюзом на отдельной машине, в natd прописан проброс 25 порта на почтовый сервер. На обоих сервера FreeBSD 7. Шлюз ipfw+natd+squid. Почта Exim+dovecot

tcpdump на внешний и на внутренний интерефес дает следующее, на внешний интерфейс:

Код: Выделить всё

/usr/home/aleksey/>tcpdump -n -i fxp0 port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on fxp0, link-type EN10MB (Ethernet), capture size 96 bytes
18:37:38.296148 IP 88.236.41.220.12089 > 87.245.165.251.25: S 416971547:416971547(0) win 65535 <mss 1452,nop,nop,sackOK>
18:37:38.818033 IP 82.146.166.144.1029 > 87.245.165.251.25: S 967478550:967478550(0) win 16384 <mss 1460,nop,nop,sackOK>
18:37:41.212719 IP 88.236.41.220.12089 > 87.245.165.251.25: S 416971547:416971547(0) win 65535 <mss 1452,nop,nop,sackOK>
18:37:41.824933 IP 82.146.166.144.1029 > 87.245.165.251.25: S 967478550:967478550(0) win 16384 <mss 1460,nop,nop,sackOK>
18:37:47.248306 IP 88.236.41.220.12089 > 87.245.165.251.25: S 416971547:416971547(0) win 65535 <mss 1452,nop,nop,sackOK>
18:37:47.755648 IP 82.146.166.144.1029 > 87.245.165.251.25: S 967478550:967478550(0) win 16384 <mss 1460,nop,nop,sackOK>
18:38:00.339771 IP 213.226.192.126.3995 > 87.245.165.251.25: S 186765182:186765182(0) win 65535 <mss 1460,nop,nop,sackOK>
18:38:03.210925 IP 213.226.192.126.3995 > 87.245.165.251.25: S 186765182:186765182(0) win 65535 <mss 1460,nop,nop,sackOK>
18:38:09.228907 IP 213.226.192.126.3995 > 87.245.165.251.25: S 186765182:186765182(0) win 65535 <mss 1460,nop,nop,sackOK>
18:39:12.944868 IP 213.226.192.126.3921 > 87.245.165.251.25: S 4013591335:4013591335(0) win 65535 <mss 1460,nop,nop,sackOK>
18:39:15.950930 IP 213.226.192.126.3921 > 87.245.165.251.25: S 4013591335:4013591335(0) win 65535 <mss 1460,nop,nop,sackOK>
18:39:21.961391 IP 213.226.192.126.3921 > 87.245.165.251.25: S 4013591335:4013591335(0) win 65535 <mss 1460,nop,nop,sackOK>
18:39:25.712374 IP 201.66.35.228.2813 > 87.245.165.251.25: S 236351132:236351132(0) win 65535 <mss 1452,nop,nop,sackOK>
18:39:28.798368 IP 201.66.35.228.2813 > 87.245.165.251.25: S 236351132:236351132(0) win 65535 <mss 1452,nop,nop,sackOK>
18:40:08.564449 IP 78.111.244.252.3813 > 87.245.165.251.25: S 3252254759:3252254759(0) win 2238 <mss 1440,nop,nop,sackOK>
18:40:11.574945 IP 78.111.244.252.3813 > 87.245.165.251.25: S 3252254759:3252254759(0) win 2238 <mss 1440,nop,nop,sackOK>
18:40:12.483874 IP 213.226.192.126.4643 > 87.245.165.251.25: S 1226242965:1226242965(0) win 65535 <mss 1460,nop,nop,sackOK>
18:40:15.446300 IP 213.226.192.126.4643 > 87.245.165.251.25: S 1226242965:1226242965(0) win 65535 <mss 1460,nop,nop,sackOK>
18:40:17.614032 IP 78.111.244.252.3813 > 87.245.165.251.25: S 3252254759:3252254759(0) win 2238 <mss 1440,nop,nop,sackOK>
...
18:42:25.150414 IP 94.178.153.14.64392 > 87.245.165.251.25: S 801406774:801406774(0) win 65535 <mss 1440,nop,nop,sackOK>
18:42:39.744974 IP 124.121.252.244.11037 > 87.245.165.251.25: S 963268206:963268206(0) win 65535 <mss 1452,nop,nop,sackOK>
18:42:40.116151 IP 83.239.61.54.3285 > 87.245.165.251.25: S 1328832444:1328832444(0) win 65535 <mss 1360,nop,nop,sackOK>
18:42:42.833549 IP 124.121.252.244.11037 > 87.245.165.251.25: S 963268206:963268206(0) win 65535 <mss 1452,nop,nop,sackOK>
18:42:42.998881 IP 83.239.61.54.3285 > 87.245.165.251.25: S 1328832444:1328832444(0) win 65535 <mss 1360,nop,nop,sackOK>
18:42:46.632237 IP 88.244.30.192.20212 > 87.245.165.251.25: S 292703994:292703994(0) win 65535 <mss 1452,nop,nop,sackOK>
18:42:48.757058 IP 124.121.252.244.11037 > 87.245.165.251.25: S 963268206:963268206(0) win 65535 <mss 1452,nop,nop,sackOK>
18:42:49.016874 IP 83.239.61.54.3285 > 87.245.165.251.25: S 1328832444:1328832444(0) win 65535 <mss 1360,nop,nop,sackOK>
18:42:49.552350 IP 88.244.30.192.20212 > 87.245.165.251.25: S 292703994:292703994(0) win 65535 <mss 1452,nop,nop,sackOK>
18:42:54.230763 IP 89.169.156.195.23970 > 87.245.165.251.25: S 2512861100:2512861100(0) win 65535 <mss 1440,nop,nop,sackOK>
18:42:55.486792 IP 88.244.30.192.20212 > 87.245.165.251.25: S 292703994:292703994(0) win 65535 <mss 1452,nop,nop,sackOK>
18:42:57.157695 IP 89.169.156.195.23970 > 87.245.165.251.25: S 2512861100:2512861100(0) win 65535 <mss 1440,nop,nop,sackOK>
18:42:59.742096 IP 124.121.252.244.11052 > 87.245.165.251.25: S 153615355:153615355(0) win 65535 <mss 1452,nop,nop,sackOK>
18:43:00.034035 IP 83.239.61.54.3307 > 87.245.165.251.25: S 4013242267:4013242267(0) win 65535 <mss 1360,nop,nop,sackOK>
18:43:02.749271 IP 124.121.252.244.11052 > 87.245.165.251.25: S 153615355:153615355(0) win 65535 <mss 1452,nop,nop,sackOK>
18:43:03.018756 IP 83.239.61.54.3307 > 87.245.165.251.25: S 4013242267:4013242267(0) win 65535 <mss 1360,nop,nop,sackOK>
18:43:03.193509 IP 89.169.156.195.23970 > 87.245.165.251.25: S 2512861100:2512861100(0) win 65535 <mss 1440,nop,nop,sackOK>
18:43:08.767281 IP 124.121.252.244.11052 > 87.245.165.251.25: S 153615355:153615355(0) win 65535 <mss 1452,nop,nop,sackOK>
18:43:09.033690 IP 83.239.61.54.3307 > 87.245.165.251.25: S 4013242267:4013242267(0) win 65535 <mss 1360,nop,nop,sackOK>

пробросилось и вышло на внутренний за тот же промежуток времени:

Код: Выделить всё

/var/log/>tcpdump -n -i rl0 port 25
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on rl0, link-type EN10MB (Ethernet), capture size 96 bytes
18:42:24.023694 IP 115.73.6.166.3642 > 192.168.0.7.25: R 27855734:27855734(0) ack 0 win 6144

natd.conf

Код: Выделить всё

log yes
same_ports yes
use_sockets yes
unregistered_only yes
redirect_port tcp 192.168.0.7:25 25
dynamic yes

ipfw.conf

Код: Выделить всё

#!/bin/sh

FwCMD="/sbin/ipfw"
LanOut="fxp0"
LanIn="rl0"
IpOut="87.245.165.251"
IpIn="192.168.0.5"
NetMask="24"
NetIn="192.168.0.0"

${FwCMD} -f flush
${FwCMD} add check-state
${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any

${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 224.0.0.0/4 in via ${LanOut}
${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
${FwCMD} add deny icmp from any to any frag
${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}

${FwCMD} add fwd ${IpIn},2121 tcp from ${NetIn}/${NetMask} to any 21 via ${LanOu
${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn}/${NetMask} to any 80 via ${Lan

${FwCMD} add divert natd ip from ${NetIn}/${NetMask} to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}

${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}
${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}

${FwCMD} add allow tcp from any to any established
${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut}

${FwCMD} add allow udp from any 53 to any via ${LanOut}
${FwCMD} add allow udp from any to any 123 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 21 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 49152-65535 via ${LanOut}
${FwCMD} add allow icmp from any to any icmptypes 0,8,11
${FwCMD} add allow tcp from any to ${IpOut} 25 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut}

${FwCMD} add allow tcp from any to any via ${LanIn}
${FwCMD} add allow udp from any to any via ${LanIn}
${FwCMD} add allow icmp from any to any via ${LanIn}

${FwCMD} add deny ip from any to any

извиняюсь сразу если недостаточно корректно изложил проблему
пните в нужную сторону

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[hizel]

лучше ipfw show покажите

[shelk]

Код: Выделить всё

/var/log/>ipfw show
00100      0        0 check-state
00200      0        0 allow ip from any to any via lo0
00300      0        0 deny ip from any to 127.0.0.0/8
00400      0        0 deny ip from 127.0.0.0/8 to any
00500  62932  9422426 deny ip from any to 10.0.0.0/8 in via fxp0
00600      0        0 deny ip from any to 172.16.0.0/12 in via fxp0
00700   2932   120401 deny ip from any to 192.168.0.0/16 in via fxp0
00800      0        0 deny ip from any to 0.0.0.0/8 in via fxp0
00900     44     4850 deny ip from any to 169.254.0.0/16 in via fxp0
01000  16965   831413 deny ip from any to 224.0.0.0/4 in via fxp0
01100      3       84 deny ip from any to 240.0.0.0/4 in via fxp0
01200      0        0 deny icmp from any to any frag
01300      0        0 deny log logamount 5 icmp from any to 255.255.255.255 in via fxp0
01400      0        0 deny log logamount 5 icmp from any to 255.255.255.255 out via fxp0
01500      0        0 fwd 192.168.0.5,2121 tcp from 192.168.0.0/24 to any dst-port 21 via fxp0
01600    161    12572 fwd 127.0.0.1,3128 tcp from 192.168.0.0/24 to any dst-port 80 via fxp0
01700    453    60761 divert 8668 ip from 192.168.0.0/24 to any out via fxp0
01800  58695 12805103 divert 8668 ip from any to 87.245.165.251 in via fxp0
01900      0        0 deny ip from 10.0.0.0/8 to any out via fxp0
02000      0        0 deny ip from 172.16.0.0/12 to any out via fxp0
02100      0        0 deny ip from 192.168.0.0/16 to any out via fxp0
02200      0        0 deny ip from 0.0.0.0/8 to any out via fxp0
02300      0        0 deny ip from 169.254.0.0/16 to any out via fxp0
02400      0        0 deny ip from 224.0.0.0/4 to any out via fxp0
02500      0        0 deny ip from 240.0.0.0/4 to any out via fxp0
02600 136618 73778071 allow tcp from any to any established
02700   1928   154355 allow ip from 87.245.165.251 to any out xmit fxp0
02800    291    67771 allow udp from any 53 to any via fxp0
02900    374    28424 allow udp from any to any dst-port 123 via fxp0
03000      0        0 allow tcp from any to 87.245.165.251 dst-port 21 via fxp0
03100      0        0 allow tcp from any to 87.245.165.251 dst-port 49152-65535 via fxp0
03200      9      558 allow icmp from any to any icmptypes 0,8,11
03300      0        0 allow tcp from any to 87.245.165.251 dst-port 25 via fxp0
03400      0        0 allow tcp from any to 87.245.165.251 dst-port 110 via fxp0
03500    486    23400 allow tcp from any to any via rl0
03600   4679   514558 allow udp from any to any via rl0
03700      0        0 allow icmp from any to any via rl0
03800   3435   215811 deny ip from any to any
65535      1       38 allow ip from any to any
/var/log/>

[hizel]

или я не вижу или нет
входящий пfкет на 25 порт 87.245.165.251
после 1800 правила представляет собой пакет вида
src-ip x.x.x.x dst-ip 192.168.0.5 dst-port 25 in via fxp0

так вот я не вижу разрешающего правила для такого покета, в конце оно упираецо собстно в deny и усё

[shelk]

03300 0 0 allow tcp from any to 87.245.165.251 dst-port 25 via fxp0 это не правило не подходит?

[shelk]

все спасибо добрый человек разобрался

[schizoid]

как совет - почитайте еще и про логирование в ipfw, для отладки - самое оно.