Quantcast
Channel: All System Administration posts
Viewing all articles
Browse latest Browse all 1179

Re: Postfix configuration - Red Hat Linux 6.4

$
0
0

Just a few comments regarding your iptables.

 

***

 

"iptables -L" gives incomplete information, so it's better to use "iptables -L -vn" instead.

 

For example, the third entry in your INPUT chain: in "iptables -L" listing, it looks like it would accept all traffic, causing the rest of the entries in that chain to be ignored.

But if your iptables ruleset is based on RHEL 6.x default iptables rules, the third entry is actually accepting traffic on loopback interface (lo) only."iptables -L -vn" listing will indicate this, but "iptables -L" will not.

 

***

 

Because the first entry in the INPUT chain is accepting all traffic with state RELATED or ESTABLISHED, there is no need to specify ESTABLISHED state on further entries in the INPUT chain. It is not harmful, just superfluous.

 

The idea is to process the first packet of each new connection using the full ruleset, then use the "RELATED,ESTABLISHED" rule as a short cut to accept all the subsequent packets in the same connection. That will minimize the amount of processing required, making your iptables more efficient.

 

***

 

Since your OUTPUT chain has ACCEPT as its default policy and no REJECT or DROP entries anywhere in it, your OUTPUT rules for smtp traffic are effectively just traffic counters: the "spt:smtp" line will measure the data sent out as a response to incoming smtp connections, and the "dpt:smtp" line will measure the amount of data sent in outgoing connections to other SMTP servers. If you don't need to track the amount of smtp traffic this way, you could remove the last two entries.


Viewing all articles
Browse latest Browse all 1179

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>