CentOS 7下Postfix端口25无法接收外部连接、端口465无法正常建立连接的问题排查求助

大家好，我在CentOS 7上配置Postfix+Dovecot时遇到了两个典型问题，想请各位帮忙排查下：

问题一：端口25无法接收外部连接 #

端口25已经开放，但外部无法连接，内部本地连接完全正常：
我在服务器上执行了本地telnet测试，流程和结果如下：

[root@myhost ~]# telnet localhost smtp

Trying ::1...

Connected to localhost.

Escape character is '^]'.

220 xxxx.com ESMTP Postfix (CentOS)

helo xxxx

250 xxxx.com

mail from:<user2@xxxx.com>

250 2.1.0 Ok

rcpt to:<user1@xxxx.com>

250 2.1.5 Ok

data

354 End data with <CR><LF>.<CR><LF>

from:user2@xxxx.com

to:user1@xxxx.com

subject:Testing email

test test

.

250 2.0.0 Ok: queued as CBE5F6039

quit

221 2.0.0 Bye

Connection closed by foreign host.

之后在Dovecot的邮件存储目录/var/mail/vhosts/xxxx.com/user1下也看到了新生成的邮件文件，说明本地SMTP（端口25）配置是正常的。

但外部尝试telnet或者发送邮件时完全没有响应，日志文件是空的。用tcpdump -i any port smtp抓包，发现端口25根本没有监听外部请求的迹象。我猜测是Linux系统层面有东西在阻止端口25对外监听，有没有朋友知道可能的原因？

问题二：端口465无法正常建立连接 #

端口465的情况是：外部telnet时服务器能收到数据包，但Postfix完全不响应；本地telnet时连接会在发送helo后断开，日志里有SSL相关的错误。

外部连接测试情况 #

在本地PC执行telnet mail.xxxx.com smtps，服务器上用tcpdump -i any port smtps能看到收到数据包，但/var/log/maillog里只有Postfix启动的日志，没有任何连接相关记录：

Aug 28 13:42:37 xxxx postfix/postfix-script[1692]: starting the Postfix mail system
Aug 28 13:42:37 xxxx postfix/master[1694]: daemon started -- version 2.10.1, configuration /etc/postfix

本地连接测试情况 #

在服务器上执行本地telnet：

[root@myhost ~]# telnet localhost smtps

Trying ::1...

Connected to localhost.

Escape character is '^]'.

helo xxxx

Connection closed by foreign host.

对应的/var/log/maillog日志如下：

Aug 28 13:45:57 xxxx postfix/smtps/smtpd[1974]: connect from unknown[::1]
Aug 28 13:46:01 xxxx postfix/smtps/smtpd[1974]: SSL_accept error from unknown[::1]: -1
Aug 28 13:46:01 xxxx postfix/smtps/smtpd[1974]: warning: TLS library problem: 1974:error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:640:
Aug 28 13:46:01 xxxx postfix/smtps/smtpd[1974]: lost connection after CONNECT from unknown[::1]
Aug 28 13:46:01 xxxx postfix/smtps/smtpd[1974]: disconnect from unknown[::1]

我怀疑要么是Postfix配置问题导致没监听465，要么是系统里有防火墙/设置阻止了服务监听，或者SSL证书配置有问题？想请教下大家的排查思路。

附相关配置文件 #

1. postconf -n输出 #

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = localhost
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = localhost, localhost.$mydomain
mydomain = xxxx.com
myhostname = xxxx.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
recipient_delimiter = +
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP $mail_name (CentOS)
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/xxxx.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/xxxx.com/privkey.pem
smtpd_tls_security_level = may
smtpd_use_tls = yes
unknown_local_recipient_reject_code = 550
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

2. /etc/postfix/main.cf部分内容 #

mail_owner = postfix
myhostname = xxxx.com
mydomain = xxxx.com
# TLS parameters
smtpd_tls_cert_file=/etc/letsencrypt/live/xxxx,com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/xxxx.com/privkey.pem
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
inet_interfaces = all
#inet_interfaces = $myhostname
#inet_interfaces = $myhostname, localhost
inet_interfaces = localhost
# Enable IPv4, and IPv6 if supported
inet_protocols = all
mydestination = localhost, localhost.$mydomain
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
recipient_delimiter = +
virtual_transport = lmtp:unix:private/dovecot-lmtp

注：这里smtpd_tls_cert_file的路径里有个逗号xxxx,com，疑似输入错误？

3. /etc/postfix/master.cf部分内容 #

smtp      inet  n       -       n       -       1       postscreen
#smtpd     pass  -       -       n       -       -       smtpd
#dnsblog   unix  -       -       n       -       0       dnsblog
#tlsproxy  unix  -       -       n       -       0       tlsproxy

submission inet n       -       -       -       -       smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_reject_unlisted_recipient=no
#-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING

465     inet  n       -       -       -       -       smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
#-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING

备注：内容来源于stack exchange，提问作者岁月倾城197