zabbix-mail iptables smtps

[console]cat /etc/ssmtp/ssmtp.conf
#
# /etc/ssmtp.conf -- a config file for sSMTP sendmail.
#
# See the ssmtp.conf(5) man page for a more verbose explanation of the
# available options.
#

# The person who gets all mail for userids < 500
# Make this empty to disable rewriting.
root=info@xxx.ru

# The place where the mail goes. The actual machine name is required
# no MX records are consulted. Commonly mailhosts are named mail.domain.com
# The example will fit if you are in domain.com and your mailhub is so named.
mailhub=smtp.yandex.ru:465

# Example for SMTP port number 2525
# mailhub=mail.your.domain:2525
# Example for SMTP port number 25 (Standard/RFC)
# mailhub=mail.your.domain
# Example for SSL encrypted connection
# mailhub=mail.your.domain:465

# Where will the mail seem to come from?
#RewriteDomain=

# The full hostname
hostname=srv-zabbix

# Set this to never rewrite the "From:" line (unless not given) and to
# use that address in the "from line" of the envelope.
FromLineOverride=NO

# Use SSL/TLS to send secure messages to server.
#UseTLS=YES
UseSTARTTLS=YES
AuthUser=info@xxx.ru
AuthPass=xxx

# Use SSL/TLS certificate to authenticate against smtp host.
#UseTLSCert=YES

# Use this RSA certificate.
#TLSCert=/etc/pki/tls/private/ssmtp.pem

# Get enhanced (*really* enhanced) debugging information in the logs
# If you want to have debugging of the config file parsing, move this option
# to the top of the config file and uncomment
#Debug=YES[/console]

и

[console]cat /etc/ssmtp/revaliases
# sSMTP aliases
#
# Format: local_account:outgoing_address:mailhub
#
# Example: root:your_login@your.domain:mailhub.your.domain[:port]
# where [:port] is an optional port number that defaults to 25.
root:info@xxx.ru:smtp.yandex.ru:465
zabbix:info@xxx.ru:smtp.yandex.ru:465[/console]

Но письма не уходят. В этом вся и проблема.
Логи mail:
[console]tail -n10 /var/log/maillog
Sep 10 09:53:22 srv-zabbix sSMTP[6361]: Creating SSL connection to host
Sep 10 10:29:04 srv-zabbix sSMTP[14122]: Creating SSL connection to host
Sep 10 10:30:12 srv-zabbix sSMTP[14390]: Creating SSL connection to host
Sep 10 10:31:22 srv-zabbix sSMTP[14657]: Creating SSL connection to host
Sep 10 11:01:34 srv-zabbix sSMTP[21232]: Creating SSL connection to host
Sep 10 11:02:43 srv-zabbix sSMTP[21511]: Creating SSL connection to host
Sep 10 11:03:22 srv-zabbix sSMTP[21626]: Creating SSL connection to host
Sep 10 11:04:34 srv-zabbix sSMTP[21901]: Creating SSL connection to host
Sep 10 11:05:13 srv-zabbix sSMTP[22040]: Creating SSL connection to host
Sep 10 11:06:23 srv-zabbix sSMTP[22285]: Creating SSL connection to host[/console]

[console]smtp.yandex.ru.urd > srv-zabbix.56937: Flags [S.], cksum 0xa997 (correct), seq 899703821, ack 3839313111, win 5592, options [mss 1410,sackOK,TS val 1503810717 ecr 5055182,n
op,wscale 3], length 0
srv-zabbix.56937 > smtp.yandex.ru.urd: Flags [.], cksum 0x13eb (incorrect -> 0xed1c), seq 1, ack 1, win 229, options [nop,nop,TS val 5055186 ecr 1503810717], length 0
smtp.yandex.ru.urd > srv-zabbix.40625: Flags [F.], cksum 0x60bb (correct), seq 1, ack 2, win 699, options [nop,nop,TS val 3810033586 ecr 5025075], length 0
srv-zabbix.40625 > smtp.yandex.ru.urd: Flags [.], cksum 0xd983 (correct), seq 2, ack 2, win 229, options [nop,nop,TS val 5060160 ecr 3810033586], length 0
srv-zabbix.56937 > smtp.yandex.ru.urd: Flags [F.], cksum 0x13eb (incorrect -> 0x5136), seq 1, ack 1, win 229, options [nop,nop,TS val 5095095 ecr 1503810717], length 0
smtp.yandex.ru.urd > srv-zabbix.56937: Flags [.], cksum 0xb376 (correct), seq 1, ack 2, win 699, options [nop,nop,TS val 1503850630 ecr 5095095], length 0[/console]

[console][root@srv-zabbix ~]# iptables-save
# Generated by iptables-save v1.4.21 on Wed Sep 10 11:25:48 2014
*nat
:PREROUTING ACCEPT [8169:692147]
:INPUT ACCEPT [1128:67020]
:OUTPUT ACCEPT [101790:6513629]
:POSTROUTING ACCEPT [101790:6513629]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_public - [0:0]
:POST_public_allow - [0:0]
:POST_public_deny - [0:0]
:POST_public_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING_ZONES -o eth0 -g POST_public
-A POSTROUTING_ZONES -g POST_public
-A POST_public -j POST_public_log
-A POST_public -j POST_public_deny
-A POST_public -j POST_public_allow
-A PREROUTING_ZONES -i eth0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Wed Sep 10 11:25:48 2014
# Generated by iptables-save v1.4.21 on Wed Sep 10 11:25:48 2014
*mangle
:PREROUTING ACCEPT [556491:122420040]
:INPUT ACCEPT [556428:122416422]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [549640:139071920]
:POSTROUTING ACCEPT [549655:139074867]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -i eth0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Wed Sep 10 11:25:48 2014
# Generated by iptables-save v1.4.21 on Wed Sep 10 11:25:48 2014
*security
:INPUT ACCEPT [549250:121782697]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [549642:139072020]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Wed Sep 10 11:25:48 2014
# Generated by iptables-save v1.4.21 on Wed Sep 10 11:25:48 2014
*raw
:PREROUTING ACCEPT [556497:122420380]
:OUTPUT ACCEPT [549642:139072020]
:OUTPUT_direct - [0:0]
:PREROUTING_direct - [0:0]
-A PREROUTING -j PREROUTING_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Wed Sep 10 11:25:48 2014
# Generated by iptables-save v1.4.21 on Wed Sep 10 11:25:48 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [120599:7608968]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_public - [0:0]
:FWDI_public_allow - [0:0]
:FWDI_public_deny - [0:0]
:FWDI_public_log - [0:0]
:FWDO_public - [0:0]
:FWDO_public_allow - [0:0]
:FWDO_public_deny - [0:0]
:FWDO_public_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -p icmp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --sport 465 -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j OUTPUT_direct
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD_IN_ZONES -i eth0 -g FWDI_public
-A FORWARD_IN_ZONES -g FWDI_public
-A FORWARD_OUT_ZONES -o eth0 -g FWDO_public
-A FORWARD_OUT_ZONES -g FWDO_public
-A FWDI_public -j FWDI_public_log
-A FWDI_public -j FWDI_public_deny
-A FWDI_public -j FWDI_public_allow
-A FWDO_public -j FWDO_public_log
-A FWDO_public -j FWDO_public_deny
-A FWDO_public -j FWDO_public_allow
-A INPUT_ZONES -i eth0 -g IN_public
-A INPUT_ZONES -g IN_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 10050 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 10051 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 465 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Wed Sep 10 11:25:49 2014[/console]

[console]iptables -L -n -V
iptables v1.4.21
[root@srv-zabbix ~]# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
550K 123M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
4654 285K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
8428 712K INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
8428 712K INPUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
8428 712K INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
7285 644K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:465

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_direct all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_IN_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_IN_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_OUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_OUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 122K packets, 7698K bytes)
pkts bytes target prot opt in out source destination
556K 140M OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
434K 132M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED

Chain FORWARD_IN_ZONES (1 references)
pkts bytes target prot opt in out source destination
0 0 FWDI_public all -- eth0 * 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 FWDI_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto]

Chain FORWARD_IN_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_OUT_ZONES (1 references)
pkts bytes target prot opt in out source destination
0 0 FWDO_public all -- * eth0 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 FWDO_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto]

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_direct (1 references)
pkts bytes target prot opt in out source destination

Chain FWDI_public (2 references)
pkts bytes target prot opt in out source destination
0 0 FWDI_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDI_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDI_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0

Chain FWDI_public_allow (1 references)
pkts bytes target prot opt in out source destination

Chain FWDI_public_deny (1 references)
pkts bytes target prot opt in out source destination

Chain FWDI_public_log (1 references)
pkts bytes target prot opt in out source destination

Chain FWDO_public (2 references)
pkts bytes target prot opt in out source destination
0 0 FWDO_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDO_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDO_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0

Chain FWDO_public_allow (1 references)
pkts bytes target prot opt in out source destination

Chain FWDO_public_deny (1 references)
pkts bytes target prot opt in out source destination

Chain FWDO_public_log (1 references)
pkts bytes target prot opt in out source destination

Chain INPUT_ZONES (1 references)
pkts bytes target prot opt in out source destination
8428 712K IN_public all -- eth0 * 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 IN_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto]

Chain INPUT_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination

Chain INPUT_direct (1 references)
pkts bytes target prot opt in out source destination

Chain IN_public (2 references)
pkts bytes target prot opt in out source destination
8428 712K IN_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
8428 712K IN_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
8428 712K IN_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0

Chain IN_public_allow (1 references)
pkts bytes target prot opt in out source destination
1029 61740 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ctstate NEW
3 180 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ctstate NEW
55 2640 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10050 ctstate NEW
56 3360 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10051 ctstate NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 ctstate NEW

Chain IN_public_deny (1 references)
pkts bytes target prot opt in out source destination

Chain IN_public_log (1 references)
pkts bytes target prot opt in out source destination

Chain OUTPUT_direct (1 references)
pkts bytes target prot opt in out source destination[/console]