WIP.

[config] / all_new_2018 / linkable_etc_files / mail / etc / iptables / rules.v4

diff --git a/all_new_2018/linkable_etc_files/mail/etc/iptables/rules.v4 b/all_new_2018/linkable_etc_files/mail/etc/iptables/rules.v4
new file mode 100644 (file)
index 0000000..7fb4279
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/mail/etc/iptables/rules.v4
@@ -0,0 +1,22 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+# otherwise self-referential connections to local host will fail
+-A INPUT -i lo -j ACCEPT
+# this enables ping etc.
+-A INPUT -p icmp -j ACCEPT
+# tolerate any inbound connections requested by our server, no matter the port
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+# SSH
+-A INPUT -p tcp --dport 22 -j ACCEPT
+# HTTPS in theory, in practice my second SSH port, see sshd_config
+-A INPUT -p tcp --dport 443 -j ACCEPT
+# SMTP (allowing for STARTTLS); necessary for mail server to mail server banter
+-A INPUT -p tcp --dport 25 -j ACCEPT
+# SMTPS, for mail server to mail user agent communication
+-A INPUT -p tcp --dport 465 -j ACCEPT
+# IMAPS
+-A INPUT -p tcp --dport 993 -j ACCEPT
+COMMIT
+# this last line is here because iptables-restore ignores the final command if no newline follows it
\ No newline at end of file