特郁闷的怪问题(iptables)，请高手指教

brucechou

我的linux(redhat9.0)用iptables做网关，并且运行postgresql服务。在iptables里面伪装了几个可以上网的IP，和开放内部所有IP收发邮件的端口。
现在问题是：每次我重新启动linux后，能上网的用户网络都正常，但是其他用户收发邮件却通不过，重起iptables服务数遍都没有用，察看状态又似乎正常。但是经过2-4小时后，发现其他用户收发邮件又突然好了。已经几次了，现在不得已我真的很害怕重新启动。实在没办法了，要不是因为在跑postgresql，早就重新安装或换别的软件做网关了

lvyanan

把你的防火墙规则提交上来，供大家斟酌斟酌嘛。

brucechou

# Generated by iptables-save v1.2.7a on Thu Oct 30 11:20:52 2003
*filter
:INPUT ACCEPT [25029]
:FORWARD ACCEPT [54188]
:OUTPUT ACCEPT [11287]
COMMIT
# Completed on Thu Oct 30 11:20:52 2003
# Generated by iptables-save v1.2.7a on Thu Oct 30 11:20:52 2003
*nat
:OUTPUT ACCEPT [0]
REROUTING ACCEPT [0]
OSTROUTING ACCEPT [0]
# -A PREROUTING -p tcp -m tcp -s 1.2.18.7 -d 1.2.0.4 --dport 2525 -j DNAT --to-destination 210.51.9.165:25
# -A PREROUTING -p tcp -m tcp -s 1.2.18.7 -d 1.2.0.4 --dport 1101 -j DNAT --to-destination 210.51.9.165:110
-A POSTROUTING -p tcp -m tcp -s 1.2.0.0/16 --dport 110 -j MASQUERADE
-A POSTROUTING -p tcp -m tcp -s 1.2.0.0/16 --dport 25 -j MASQUERADE
-A POSTROUTING -p tcp -m tcp -s 1.2.0.0/16 --dport 4009 -j MASQUERADE
-A POSTROUTING -p tcp -m tcp -s 1.2.0.32 --dport 21 -j MASQUERADE
-A PREROUTING -p tcp -m tcp --dport 8888 -j DNAT --to-destination 1.2.0.3:8888
-A PREROUTING -p tcp -m tcp --dport 20 -j DNAT --to-destination 1.2.0.3:20
#-A PREROUTING -p tcp -m tcp --dport 5631 -j DNAT --to-destination 1.2.0.6:5631
#-A PREROUTING -p tcp -m tcp --dport 5632 -j DNAT --to-destination 1.2.0.6:5632
-A POSTROUTING -s 1.2.0.2 -j MASQUERADE
-A POSTROUTING -s 1.2.0.3 -j MASQUERADE
-A POSTROUTING -s 1.2.0.5 -j MASQUERADE
-A POSTROUTING -s 1.2.0.6 -j MASQUERADE
-A POSTROUTING -s 1.2.0.7 -j MASQUERADE
-A POSTROUTING -s 1.2.0.21 -j MASQUERADE
-A POSTROUTING -s 1.2.0.22 -j MASQUERADE
-A POSTROUTING -s 1.2.0.23 -j MASQUERADE
-A POSTROUTING -s 1.2.0.24 -j MASQUERADE
-A POSTROUTING -s 1.2.0.25 -j MASQUERADE
-A POSTROUTING -s 1.2.0.26 -j MASQUERADE
-A POSTROUTING -s 1.2.0.27 -j MASQUERADE
-A POSTROUTING -s 1.2.0.28 -j MASQUERADE
-A POSTROUTING -s 1.2.0.29 -j MASQUERADE
-A POSTROUTING -s 1.2.0.30 -j MASQUERADE
-A POSTROUTING -s 1.2.0.31 -j MASQUERADE
-A POSTROUTING -s 1.2.0.33 -j MASQUERADE
-A POSTROUTING -s 1.2.0.34 -j MASQUERADE
#A POSTROUTING -p tcp -m tcp -m multiport -s 1.2.18.197 --ports 110 -j MASQUERADE
-A POSTROUTING -s 1.2.0.51 -j MASQUERADE
-A POSTROUTING -s 1.2.0.52 -j MASQUERADE
-A POSTROUTING -s 1.2.0.53 -j MASQUERADE
-A POSTROUTING -s 1.2.0.54 -j MASQUERADE
-A POSTROUTING -s 1.2.0.55 -j MASQUERADE
COMMIT
# Completed on Thu Oct 30 11:20:52 2003
# Generated by iptables-save v1.2.7a on Thu Oct 30 11:20:52 2003
*mangle
REROUTING ACCEPT [80110]
:INPUT ACCEPT [25029]
:FORWARD ACCEPT [54188]
:OUTPUT ACCEPT [11448]
OSTROUTING ACCEPT [65475]
COMMIT
# Completed on Thu Oct 30 11:20:52 20