I am having a problem implementing iptables with Courier's pop3 daemon. If I disable iptables, everything works fine. As soon as I enable it, pop3 will stop working for messages over 32K. Small messages will go through with no problems, but large ones will time out.
I get this message from OE: "Your POP3 server has not responded in 60 seconds." And an option to stop or continue waiting. I can wait as long as I want, but it will not download the message.
This problem only exists with connections coming from outside our network. Connections from within the network can download large messages with no problems.
Has anyone seen this before? I would like to implement iptables for more security, but I can't do it if this problem persists.
My server is: P4 2.8, 1GB RAM CentOS 4.3 (fully patched) Courier 0.53.1
My iptables rules were initially created with system-config-securitylevel and then modified from there. The current rules are:
Chain INPUT (policy ACCEPT) target prot opt in out source destination RH-Firewall-1-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT) target prot opt in out source destination RH-Firewall-1-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT) target prot opt in out source destination
Chain RH-Firewall-1-INPUT (2 references) target prot opt in out source destination ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 255 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:53 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:587 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 ACCEPT tcp -- * * 172.16.0.0/16 0.0.0.0/0 state NEW tcp dpt:22 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:995 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
I have found information on Google indicating that this might be a problem with the MTU or MSS setting, but the solutions given seemed to be aimed at the end user rather than the server. I tried them anyway, but they didn't seem to help.
This is what was generally suggested:
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ -j TCPMSS --clamp-mss-to-pmtu
It didn't get any hits on the FORWARD chain. I put it on the OUTPUT chain and it got some hits there, but didn't have any effect on the problem. I also tried the --set-mss option with the same lack of results.
I appreciate any suggestions.
-- Bowie