Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteTo open SMTP port 25 on Ubuntu, you need three things working at the same time: an SMTP service listening on the server, a host firewall rule permitting TCP/25, and any upstream cloud or network firewall allowing the connection. A UFW rule by itself does not create a mail service.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Check the listener with sudo ss -utlnp | grep ':25', allow the port with sudo ufw allow 25/tcp, verify the effective policy, and test from a different machine with nc -vz server.example.com 25 or telnet mail.example.com 25. The guide below explains each layer, how to restrict access, and how to diagnose a port that still appears closed.
As an Amazon Associate I earn from qualifying purchases.
What an open port 25 actually means
Ubuntu security documentation defines an open port as a network port that is bound to a service and actively listening for incoming connections or packets. In practical terms, opening port 25 is not a single firewall command. It is the result of three independent conditions:
- A local SMTP daemon is listening. A process such as Postfix must bind to TCP port 25 on an address reachable by the intended clients.
- The Ubuntu host firewall permits the traffic. If UFW is active and denies TCP/25, packets can reach the server but will not be accepted.
- Upstream controls permit the traffic. A cloud security group, hosting-provider egress or ingress policy, router ACL, or corporate network may block port 25 even when UFW is configured correctly.
These layers explain the common situation in which an administrator adds an allow rule but an outside test still fails: the rule changes only one layer, and a firewall rule cannot make a non-listening port accept connections.
#1 Best Overall
Decide whether you need inbound port 25
Inbound Internet delivery
Port 25 is the traditional server-to-server SMTP channel. A server receiving mail directly from other mail systems needs an SMTP daemon listening on TCP/25 and must be prepared to handle untrusted Internet traffic. That normally means configuring Postfix (or another SMTP server), setting recipient and relay policy, and ensuring DNS and mail-routing choices are correct for your domain. Opening the port before those controls are in place can expose a misconfigured service.
Outbound delivery or relay
Do not expose port 25 merely because an application must send mail. Outbound SMTP and inbound delivery are different traffic directions and policy decisions. An application can submit mail to a local or managed relay without accepting unsolicited inbound connections. If your provider supplies a relay, follow its connection and authentication requirements instead of creating a public listener.
Private senders and relays
If only one known system should connect, use a source-restricted UFW rule rather than permitting every address on the Internet. This is appropriate for a backup mail host, an internal application, or a designated relay. Confirm that the sender’s address is stable; dynamic addresses can make a narrowly scoped rule stop working.
Check the server before changing UFW
Confirm the current firewall state
Run:
sudo ufw status verbose
sudo ufw status numberedstatus verbose shows whether UFW is active and displays the default policies. status numbered lists rules with numbers, which is useful when you later need to insert, remove, or audit a rule. If UFW is inactive, the absence of a UFW rule does not prove that the port is reachable; another firewall may still be filtering traffic.
Find a process listening on TCP/25
Run:
sudo ss -utlnp | grep ':25'The command lists listening TCP and UDP sockets and the owning process. A result containing TCP port 25 identifies the daemon that will answer connections. Pay attention to the local address: a listener bound only to a loopback address such as 127.0.0.1:25 accepts local connections but is not reachable through the server’s external address. A listener on an external IPv4 address, 0.0.0.0:25, or an appropriate IPv6 address can accept traffic on those interfaces, subject to firewall and provider policy.
If the command returns no line for port 25, stop at this point and configure an SMTP service. Adding a UFW rule while no daemon is listening will still produce connection refusals or timeouts from remote clients.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteInstall and configure an SMTP service
Use Postfix when the server must receive mail
Ubuntu documents Postfix as an SMTP server. Install it from the Ubuntu package repositories using your normal package-management process, then complete the package configuration for the server’s hostname, mail domain, local destinations, and delivery model. A typical installation command is:
sudo apt update
sudo apt install postfixDuring setup, choose the mode that matches your architecture. A server delivering mail directly needs a configuration that accepts mail for domains it is authoritative for; a relay-only host should send through its designated relay and should not act as an open relay. Review the generated configuration before exposing it to untrusted networks.
Verify the daemon and binding
After configuration, restart or reload Postfix using the service-management method appropriate to your Ubuntu release, then run the ss command from the previous section again. The expected result is a Postfix process listening on TCP/25 at the interface intended for incoming connections. If it listens only on loopback, adjust the service’s interface settings deliberately rather than opening the firewall and assuming the bind address will change automatically.
Apply relay and authentication controls first
Postfix must not accept arbitrary messages from arbitrary senders for arbitrary destinations. Configure relay restrictions and authentication-related settings before accepting Internet traffic. Ubuntu’s Postfix guidance notes that the Ubuntu package installs in a chroot by default as a security measure; retain that protection unless you have a documented reason to change it and understand the operational consequences. Test local delivery, rejected recipients, and authenticated relay behavior before publishing the service.
Recommended Free Tools
Allow TCP port 25 through UFW
Preview the change
You can inspect the rule UFW would generate without applying it:
sudo ufw --dry-run allow 25/tcpThis is useful on production systems where a change should be reviewed before it alters the active policy.
Add an unrestricted rule
To allow TCP port 25 from any source address permitted by other network controls, run:
sudo ufw allow 25/tcpUFW also accepts the service-name form:
sudo ufw allow smtpThe explicit protocol form is easier to audit because it states that only TCP/25 is being allowed. SMTP is a TCP service; opening UDP/25 is not required for SMTP connections.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Enable UFW safely on a remote server
If UFW is not active and you intend to enable it, make sure your SSH rule is present first. Otherwise, enabling the firewall can terminate your administrative access. A safe sequence is to permit SSH according to your management policy, add the required mail rule, and only then run:
sudo ufw enableCheck the result with:
sudo ufw status verboseConfirm that the output shows UFW active, the expected default policies, and an allow rule for TCP/25. If a provider firewall is also in use, the host-level status is only one part of the final path.
Restrict the source when possible
For a known sender or relay, limit the rule to its address:
sudo ufw allow from 203.0.113.10 to any port 25 proto tcpThe address above is an example documentation address. Replace it with the real, stable source address authorized to connect. A source restriction reduces exposure, but it does not replace SMTP authentication or relay controls inside Postfix.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
Check provider and network firewalls
Cloud platforms and hosting networks may filter SMTP independently of Ubuntu. Some accounts or regions restrict inbound or outbound port 25 to reduce abuse. A router, perimeter firewall, virtual network ACL, or corporate egress policy can have the same effect. Check the provider’s firewall or security-group configuration for the server’s actual account and region, and verify that it allows inbound TCP/25 from the sources you intend to serve.
Keep the scopes aligned. An unrestricted UFW rule cannot override a provider rule that permits only one address, and a provider rule cannot make a local service reachable when Postfix is bound only to loopback. Document both policies so a later administrator does not remove one layer believing the other still provides protection.
Test port 25 from another machine
Use netcat for a TCP reachability test
From a host outside the Ubuntu server’s network, run:
nc -vz server.example.com 25Use the server’s public DNS name or address. A successful result means that a TCP handshake completed from that source to port 25. It does not prove that the SMTP service has correct DNS, TLS, authentication, recipient policy, relay restrictions, or mail reputation.
Use Telnet to observe the SMTP banner
Ubuntu’s Postfix documentation uses:
telnet mail.example.com 25If the connection succeeds, an SMTP server normally presents a greeting banner. The banner confirms that an application answered after the TCP handshake, while a timeout or refusal points to a different layer. Exit the Telnet session without sending test mail unless you understand the SMTP commands and the recipient policy configured on the server.
Test from the right source
A test from the same server can succeed even when Internet clients are blocked, because it may bypass provider filters or use the loopback interface. Perform at least one test from a separate network, and repeat it from each source that should be authorized when you use a source-restricted rule. If IPv4 and IPv6 are both published, test each address family separately; a working IPv4 path does not guarantee an IPv6 path.
Troubleshoot a port that still appears closed
| Observed result | Likely layer | What to check next |
|---|---|---|
ss shows no listener on 25 |
Service | Install or start Postfix, inspect its configuration and logs, and verify again with sudo ss -utlnp | grep ':25'. |
| Local test works, remote test is refused | Binding or service policy | Check whether Postfix listens only on loopback or a private address. Confirm that the daemon is configured to accept connections on the intended interface. |
| Remote test times out, but a listener exists | Firewall or upstream network | Review sudo ufw status verbose, provider security rules, router ACLs, and any account-level SMTP restrictions. |
| UFW rule exists but traffic is denied | Rule order or source scope | Use sudo ufw status numbered to inspect ordering and whether an earlier deny or a source-restricted rule matches the client. |
| TCP handshake succeeds, but SMTP rejects mail | Postfix policy | Check recipient domains, relay restrictions, authentication, TLS requirements, and the server’s mail-domain configuration. Port reachability is already established. |
| One network can connect and another cannot | Path-specific filtering | Compare source addresses, IPv4 versus IPv6, provider rules, and the exact DNS address each client resolved. |
Do not “fix” a timeout by repeatedly adding identical UFW rules. First identify which layer failed. Duplicate rules make audits harder and do not repair a missing listener or an upstream block.
Best Value
Security considerations before public exposure
Minimize the exposed surface
Ubuntu warns that open ports on untrusted networks create risk when the listening service is vulnerable or misconfigured. Open only ports required by the architecture, keep Ubuntu and Postfix updated through your normal maintenance process, and remove temporary test rules when the work is complete.
Prevent open-relay behavior
An Internet-facing SMTP listener must distinguish mail addressed to domains it serves from attempts to relay to arbitrary destinations. Configure relay restrictions and authentication before allowing broad ingress. Test both an authorized message path and an unauthorized relay attempt from a controlled client; the latter should be rejected according to your policy.
Protect administrative access
When changing UFW remotely, preserve a tested SSH rule before enabling or tightening the firewall. Keep a console or out-of-band recovery path available for production systems. Record the source-restricted addresses, provider rules, and the person responsible for each exception.
Separate transport security from port access
A successful connection to TCP/25 does not establish encryption, authentication, or sender reputation. Those are properties of the SMTP configuration and the mail system around it. Treat the firewall rule as network reachability only, then validate the protocol and identity controls independently.
Choose the implementation that fits the mail flow
| Approach | When it fits | Port-25 exposure | Administrative trade-off |
|---|---|---|---|
| Local Postfix receiving Internet mail | The server is responsible for accepting mail for its domains. | Usually public inbound TCP/25, subject to provider approval. | You manage updates, relay policy, authentication, logs, DNS, and reputation. |
| Source-restricted Postfix | Only a known relay, application, or private network should connect. | TCP/25 allowed only from specified addresses. | Lower exposure, but address changes require firewall updates. |
| Managed relay | An external mail service handles delivery and policy. | Inbound port 25 on the Ubuntu host may be unnecessary. | Less local mail administration; you must follow the relay’s authentication and network requirements. |
| Authenticated submission on another service port | Applications or users send through a controlled submission endpoint. | Port 25 need not be open to the public for this use. | Clients authenticate to submit; exact port and TLS settings come from the service configuration. |
| Provider firewall plus UFW | Servers protected by both host and cloud or perimeter controls. | Both layers must permit the same intended sources. | Provides layered policy, but troubleshooting requires checking both rule sets. |
Provider restrictions vary by account and region, so confirm the policy for the specific server instead of assuming that a rule documented for another environment applies to yours.
Remove the rule when port 25 is no longer needed
Closing an unnecessary port reduces exposure. Remove the unrestricted rule with:
sudo ufw delete allow 25/tcpIf you created a source-restricted rule, delete that exact rule. Use sudo ufw status numbered first if you need to identify the rule’s number, then verify the resulting policy with sudo ufw status verbose. Removing the UFW rule does not stop Postfix; it only changes whether the host firewall permits matching traffic. Stop or reconfigure the service separately if the listener itself should disappear.
End-to-end procedure
Use this sequence when you need a repeatable change window:
- Define the mail flow: direct inbound delivery, a private relay, application submission, or a managed relay.
- Confirm that exposing inbound TCP/25 is required for that flow and obtain any provider approval.
- Install and configure Postfix or the SMTP service, including recipient, relay, and authentication policy.
- Run
sudo ss -utlnp | grep ':25'and verify that the process listens on the intended address rather than only loopback. - Review UFW with
sudo ufw status verboseandsudo ufw status numbered. Preserve SSH access before enabling UFW. - Preview and apply either
sudo ufw allow 25/tcpor a source-restricted rule such assudo ufw allow from 203.0.113.10 to any port 25 proto tcp. - Align cloud, provider, router, and perimeter policies with the same source and protocol scope.
- From an external machine, run
nc -vz server.example.com 25ortelnet mail.example.com 25, then test SMTP policy separately. - Document the rule and remove it with
sudo ufw delete allow 25/tcpwhen the mail flow no longer needs inbound port 25.
If the external handshake succeeds, the network path to port 25 is open. Any remaining failure belongs to SMTP configuration, authentication, DNS, recipient policy, TLS, or mail-delivery reputation rather than the UFW allow rule itself.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
