protect postfix from outside

iptables -A INPUT -p tcp -s 127.0.0.0/8 --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP