Issue Almalinux 9 and Firewall

[OverWolf]

Server operating system version

Almalinux 9

Plesk version and microupdate number

18.0.52

Hi,

I've tested that any change that I do with Firewall with Plesk interface, it isn't working. If I want to apply it I must connect to server (ssh) and use command firewall-cmd --add-port=xxxx.

Why ?

 

[Peter Debik]

Which firewall software are you using?

 

[OverWolf]

Hi Peter,
I'm using Plesk Firewall :

The Plesk Firewall (Linux)

By default, the Plesk firewall configuration consists of policies and rules. Policies are broad in scope and affect a...

docs.plesk.com

 

[OverWolf]

I've seen that Plesk have its interface :

plesk (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens3
  sources:
  services:
  ports: 22/tcp 21/tcp 25/tcp 53/tcp 53/udp 80/tcp 110/tcp 143/tcp 443/tcp 465/tcp 587/tcp 993/tcp 995/tcp 8443/tcp 8447/tcp 8880/tcp
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

is this the problem ?

 

[Peter Debik]

Plesk is only the user interface. Problems exist when two server-side firewalls are in use. Are you using iptables and firewalld at the same time for example? See the red warning message on top of (Plesk for Linux) The Plesk Firewall

 

[OverWolf]

Hi Peter,

on Almalinux there is firewalld 1.2.1 (only firewalld) and then I've installed Plesk. So, I think that Plesk Firewall can work as expect, but no, it seems that Plesk is working on its zone, while firewalld is working on zone=public (that zone that it's the default for incoming traffic)

 

[Peter Debik]

So far I've not seen similar reports. Would it be possible that you open a ticket with Plesk support so that an engineer can examine this behavior on your server?

 

[OverWolf]

Hi,

how can I remove ftp passive mode rules and set my rules?

I've seen that in firewall zone plesk, there are this ports open 49152-65535/tcp and I think that there are for fpt, but I want to modify this range.

How can I do ?

P.S.:
I've tried to remove this range from firewall-cmd command but this ports remain open.

 

[Peter Debik]

Do not close these ports. It will only prohibit FTP to work and will also have an effect on other services who need random ports for data transfers. It also makes no sense to only close part of these ports, because then software will just use the remaining, narrowing the number of available ports if several services and users concurrently want to transfer data from and to the servers.