Use iptables to get rid of error on status page about closed port 25

Unsupported Modifications
1

My Mail-in-a-Box runs on a DigitalOcean instance, which means that outbound port 25 is closed. There is a well documented method to use something like Sendgrid as a relay to send email and this works perfectly for me. Here’s a forum link in case you don’t know: Digitalocean with Sendgrid SMTP Relay - #3 by AskinSavascisi

I just had one little annoyance, and that is that the Mail-in-a-Box status page reports an error about outbound port 25 being closed. I think it does a connection check to Google’s SMTP servers(*), I could check that to be sure but it doesn’t matter. I came up with a really dirty hack to get rid of the error: I just redirect all outgoing network traffic on port 25 to port 465:

iptables -t nat -A OUTPUT -p tcp --dport 25 -j REDIRECT --to-port 465

How to persist this across reboots, is left as an exercise to the reader. :wink:

This works for me because:

  • Mail-in-a-Box is the only application on my server that attempts a direct SMTP connection to the outside world. All other applications should deliver their mail to whatever is the local default mailserver, which is Postfix, and then Postfix takes on the responsibility to actually deliver the email.
  • Should there every be any other application that bypasses Postfix and attempts a direct SMTP connection to the outside world, then that’s my problem to deal with. But I don’t expect that.
  • I chose port 465 because that’s a port for secure SMTP submission. Apparently this is a agreeable for Mail-in-a-Box. I probably could have used port 587 as well. Or maybe even any random non-blocked port? I don’t know. I tried the first thing I could think of, and the error in Mail-in-a-Box was gone, and I’m happy.

Use at your own risk!

(*) I did some digging in the source code of Mail-in-a-Box: the file /root/mailinabox/setup/network-checks.sh does the following check:

# Stop if we cannot make an outbound connection on port 25. Many residential
# networks block outbound port 25 to prevent their network from sending spam.
# See if we can reach one of Google's MTAs with a 5-second timeout.
if ! nc -z -w5 aspmx.l.google.com 25; then
        echo
        echo "Outbound mail (port 25) seems to be blocked by your network."
        echo
        echo "You will not be able to send mail using this machine, so setup"
        echo "cannot continue."
        echo
        echo "Many residential networks block port 25 to prevent hijacked"
        echo "machines from being able to send spam. I just tried to connect"
        echo "to Google's mail server on port 25 but the connection did not"
        echo "succeed."
        echo
        exit 1
fi

So, it’s just a simple netcat connection test to aspmx.l.google.com on port 25. I code have done any other valid port redirection and have the same result.

1 Like