smtp/transport being filtered in private networking

Hello,

I have a couple droplets in nyc2, and one of them is running postfix. However, if I try to connect to both ports 25 and 587 from another droplet through the private network interface, the connection times out. Nmap shows those ports ate being filtered (not by me though):

$  nmap XXX.XXX.XXX.XXX -p 25,587
Starting Nmap 6.46 ( http://nmap.org ) at 2014-08-22 14:26 UTC
Nmap scan report for XXX.XXX.XXX.XXX
Host is up (0.00044s latency).
PORT    STATE    SERVICE
25/tcp  filtered smtp
587/tcp filtered submission

Nmap done: 1 IP address (1 host up) scanned in 1.26 seconds

Postfix is listening correctly:

# lsof -i tcp:25
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
master  4873 root   12u  IPv4  11491      0t0  TCP *:smtp (LISTEN)
master  4873 root   13u  IPv6  11492      0t0  TCP *:smtp (LISTEN)

Just to be sure, I set postfix to listen in port 23, and was able to successfully connect:

$ telnet XXX.XXX.XXX.XXX
Trying XXX.XXX.XXX.XXX...
Connected to XXX.XXX.XXX.XXX.
Escape character is '^]'.
220 Polibra ESMTP Postfix
^]
telnet> q
Connection closed.

Is that normal behavior?

Thanks