Firewall Rules for a Mail Server

SMTP for other mail servers, submission and IMAPS for your users, and HTTPS for webmail. The services are already ticked: add your own addresses and pick your firewall.

  • Free
  • No Sign-Up
  • Runs in Your Browser

Services to Open

Check Before You Apply

SSH is open to the whole internet. Limit it to your own addresses if they are fixed.

These rules replace the existing input rules. Check nothing else (Docker, fail2ban, the Proxmox firewall) manages this server's firewall first.

/etc/nftables.conf

#!/usr/sbin/nft -f
# /etc/nftables.conf: generated at frabs.net/tools/firewall-rule-generator/
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif "lo" accept
    ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } limit rate 10/second accept
    ip6 nexthdr icmpv6 accept  # IPv6 needs ICMPv6 for neighbour discovery
    tcp dport 22 accept  # SSH
    tcp dport 443 accept  # HTTPS
    tcp dport 25 accept  # SMTP
    tcp dport { 465, 587 } accept  # Mail Submission
    tcp dport { 993, 995 } accept  # IMAPS / POP3S
  }

  chain forward {
    type filter hook forward priority 0; policy accept;
  }

  chain output {
    type filter hook output priority 0; policy accept;
  }
}

# Apply:  nft -f /etc/nftables.conf
# Keep at boot:  systemctl enable nftables

Firewall Rule Generator

Mail Server firewall

Opensmtp, submission, imap, https
DefaultDrop everything else coming in
OutboundAllowed
SSHLimit to your addresses

SMTP for other mail servers, submission and IMAPS for your users, and HTTPS for webmail.

Apply the rules from a session you can recover: a provider console, or with a scheduled rollback, so a mistake cannot lock you out.

Server Types

Web ServerMail ServerProxmox HostDatabase ServerWireGuard VPNMinecraft ServerDNS Server

Questions

Which ports should a mail server open?
SMTP for other mail servers, submission and IMAPS for your users, and HTTPS for webmail.

Free Tools

More tools

All Tools
Firewall Rule GeneratorGenerate iptables, nftables and UFW rules for common server set-ups.What Is My IPYour public IP address, reverse DNS, network and ASN.Subnet CalculatorNetwork, broadcast, usable range and mask for any IPv4 or IPv6 CIDR.Chmod CalculatorLinux file permissions in octal and symbolic form, both ways.

Firewalls stop traffic coming in

Frabs stops the abuse going out: spam, scans and floods from any VM, caught by behaviour, not by port.

Start Free TrialTry the Demo