Service only listens on 127.0.0.1 port 1025. How do you allow any computer on your local network to communicate with this service?
0
votes
1
answer
784
views
Let me open by saying I have scoured the internet, even companies I purchased the software from and it's been 5 months!! So I am turning to the community as my eyes and brain are bleeding from reading and trying this long getting no where. In short, can this be done, YES. Apparently I am too stupid to do it, however at least I have a huge knowledge of iptables now :-)
My requirement: I use protonmail for my email. If you didn't know, it's so secure, that you have to run a "bridge software" running on each machine that needs to send/receive email. I simply want to send emails from myself, to myself, for my smart home, cameras, alerts, etc etc. As you can imagine I can not install this software on 20 devices let alone cameras!!! So I need a single linux server running this software to act as the email "hub"
My network is 192.168.10.0/24 no vlans, no complications (pfsense as my router/firewall)
I am using mxlinux / debian as my "email host" 192.168.10.106 IMAP is listening on port 1143 SMTP is listening on port 1025
All I wanted to do was make it so that ANY device on my network can use 192.168.10.106 to send emails using SMTP on port 1025. Thought this would be easy..but noooooooooooooooooooo simply because the damn software will ONLY listen on 127.0.0.1 !!! I can not change it to something like 0.0.0.0 etc.
First you should know I contacted protonmail directly as it's a paid email service they actually have techs that know what they are doing and talk with you. However, they feel it's a "security risk" to allow their service to listen on 0.0.0.0 so the code will not allow this to be changed. I did the below on the "email server / 192.168.10.106"
1. Edited
/etc/sysctl.conf
and uncommented the #
in front of net.ipv4.ip_forward=1
2. Updated iptables
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp -s 192.168.10.0/24 --dport 1025 -j DNAT --to-destination 127.0.0.1:1025
sudo iptables -t nat -A POSTROUTING -o lo -p tcp --dport 1025 -j SNAT --to-source 192.168.10.106
sudo iptables -A FORWARD -i eth0 -o lo -p tcp --dport 1025 -j ACCEPT
3. Make my entries save on reboot and it's going to ask me if I want to save my above tables, I need to say yes, so I will:
sudo apt install iptables-persistent
4. Go into MX "firewall configuration" and turn off "public, private and office", basically turn off the firewall
5. Reboot the computer
OK now listing out after a reboot it looks like this. I tried from a windows computer on my network 192.168.10.50 to telnet and as you can see I am seeing packets but it's not working :-( :-( :-( :-( :-( :-( :-( :-( :-( :-( :-(
sudo iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 15748 packets, 1719K bytes)
pkts bytes target prot opt in out source destination
5 260 DNAT tcp -- eth0 * 192.168.10.0/24 0.0.0.0/0 tcp dpt:1025 to:127.0.0.1:1025
Chain INPUT (policy ACCEPT 15748 packets, 1719K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 730 packets, 73256 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 730 packets, 73256 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT tcp -- * lo 0.0.0.0/0 0.0.0.0/0 tcp dpt:1025 to:192.168.10.106
This is me testing the service on the local host email computer
$ telnet 127.0.0.1 1025
Trying 127.0.0.1... Connected to 127.0.0.1.
Escape character is '^]'.
220 127.0.0.1 ESMTP Service Ready
Notice the dropped packets in eth0 received side
$ uname -a
Linux email 5.10.0-23-amd64 #1 SMP Debian 5.10.179-2 (2023-07-14) x86_64 GNU/Linux
bob@email:~ $ ifconfig
eth0: flags=4163 mtu 1500
inet 192.168.10.106 netmask 255.255.255.0 broadcast 192.168.10.255
ether 00:0c:29:63:d5:4f txqueuelen 1000 (Ethernet)
RX packets 126620 bytes 24077186 (22.9 MiB)
RX errors 0 dropped 6447 overruns 0 frame 0
TX packets 30080 bytes 3728557 (3.5 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73 mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1000 (Local Loopback)
RX packets 57 bytes 4931 (4.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 57 bytes 4931 (4.8 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
None of the above worked so I tried different variations. I also found a command I was suggested to use that did not seem to help but tried it anyway.
sysctl -w net.ipv4.conf.eth0.route_localnet=1
Asked by Frank
(13 rep)
Jul 31, 2023, 02:53 PM
Last activity: Aug 1, 2023, 06:01 PM
Last activity: Aug 1, 2023, 06:01 PM