[CentOS] iptables question

[Bowie Bailey]

Kai Schaetzl wrote:
> Bowie Bailey wrote on Mon, 19 Oct 2009 17:18:16 -0400:
>
>   
>> The destination address is the private IP of the server.  These
>> seem to be related to outgoing email connections based on the source
>> IPs
>>     
>
> Is 195.140.240.6 the public IP of that machine? Why do you obfuscate a 
> private IP number? Do you want to say that these are internal mail server 
> connections? If not, the explanation about the IP numbers doesn't make 
> sense to me.
>   

No,  195.140... is the IP of the remote machine.  I obfuscated the
private IP of the mail server (and MAC address) on general principles
since they are not relevant to the question.

What I am seeing is a remote server trying to make a connection from
port 25 to a high-numbered port on my mail server.  Iptables rejects the
connection since it is not on an allowed port or part of an established
conversation.  The question is:  why are all of these remote servers
trying to make connections back to me on high-numbered ports?  Should I
be allowing these connections somehow?

For clarity's sake, here are a few non-obfuscated examples:

Oct 20 11:42:27 bnofmail kernel: REJECT: IN=eth0 OUT=
MAC=00:50:8d:59:60:2e:00:90:27:c2:79:77:08:00 SRC=209.27.55.194
DST=172.16.17.169 LEN=107 TOS=0x00 PREC=0x00 TTL=52 ID=56970 DF
PROTO=TCP SPT=25 DPT=40312 WINDOW=62928 RES=0x00 ACK PSH FIN URGP=0
Oct 20 11:42:49 bnofmail kernel: REJECT: IN=eth0 OUT=
MAC=00:50:8d:59:60:2e:00:90:27:c2:79:77:08:00 SRC=203.17.219.68
DST=172.16.17.169 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=19851 DF
PROTO=TCP SPT=25 DPT=40289 WINDOW=64167 RES=0x00 ACK FIN URGP=0
Oct 20 11:43:01 bnofmail kernel: REJECT: IN=eth0 OUT=
MAC=00:50:8d:59:60:2e:00:90:27:c2:79:77:08:00 SRC=204.127.217.16
DST=172.16.17.169 LEN=72 TOS=0x00 PREC=0x20 TTL=50 ID=15125 DF PROTO=TCP
SPT=25 DPT=40346 WINDOW=64296 RES=0x00 ACK URGP=0

172.16.17.169 is the private IP of one of my mailservers.  The other IPs
are remote servers not under my control.  About 20% of them are servers
that have received outbound email from my server recently.  I have no
idea where the others come from. 

I have gotten over 83,000 of these connection attempts so far today from
267 unique IP addresses.

-- 
Bowie