1

Тема: Стандартный iptables для почтового сервера

Не забудьте поставить file2ban
#============================================
# Generated by iptables-save v1.4.21 on Wed Aug  3 11:56:39 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o enp1s0 -j MASQUERADE
-A POSTROUTING -o enp2s0 -j MASQUERADE
COMMIT
# Completed on Wed Aug  3 11:56:39 2016
# Generated by iptables-save v1.4.21 on Wed Aug  3 11:56:39 2016
*filter
:INPUT DROP [368:34371]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:f2b-default - [0:0]
:f2b-dovecot - [0:0]
:f2b-postfix - [0:0]
:f2b-roundcube - [0:0]
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-postfix
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-dovecot
-A INPUT -p tcp -m multiport --dports 80,443,25,587,110,995,143,993,4190 -j f2b-roundcube
-A INPUT -p tcp -j f2b-default
-A INPUT -p tcp -j f2b-default
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10050 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5280 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9090 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.0.0/16 -i enp1s0 -m state --state NEW -j ACCEPT
-A FORWARD -s 192.168.0.0/16 -i enp2s0 -m state --state NEW -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A f2b-default -s 221.194.44.219/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-default -j RETURN
-A f2b-default -j RETURN
-A f2b-dovecot -j RETURN
-A f2b-postfix -s 85.25.150.55/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix -j RETURN
-A f2b-roundcube -j RETURN
COMMIT
# Completed on Wed Aug  3 11:56:39 2016

Ну как то так....