Issue Can't confirm firewall rules from CLI

[MariuszB]

Server operating system version

CentOS Linux 7.9.2009 (Core)

Plesk version and microupdate number

Plesk Obsidian 18.0.52 #2

I can't confirm firewall rules from cli after last update. From Plesk interface is ok.

/usr/local/psa/bin/modules/firewall/settings -a
The firewall rules were activated. To save your changes, run the --confirm command within 120 second(s).

/usr/local/psa/bin/modules/firewall/settings -c
Too late to confirm: no rules activation process
Unable to confirm the firewall rules.

exit status 1

As you see I tried rise timeout but this is not change anything. I tried wait 1 second or 60 seconds without success. After apply command nothing in iptables rules was added so nothing was to confirm.

 

[MarkM]

Might be related to;

Resolved - Firewall disabled

Hi all, I'm having problems enabling Plesk Firewall. It had been working perfectly the last two years, but now it's disabled and can't find a way to enable it again. I'm not sure where this issue come from, but: a few days ago I removed a custom rule (for varnish) -> Firewall told me it had to...

talk.plesk.com

Have you installed the updated firewall extension from earlier in the month to see if that addresses your issue?

 

[MariuszB]

I have 2.0.2-352.

 

[Kaspar]

See: Resolved - Failed to apply the firewall configuration

 

[MariuszB]

As you can see in my first post I already set higher timeout. I would like to note problem exists only in cli.

 

[Peter Debik]

MariuszB If you believe that you have found a bug, please report it here: Reports

 

[Kaspar]

As you can see in my first post I already set higher timeout. I would like to note problem exists only in cli.

Sorry about that, I must admit I missed that part in your first post.

/usr/local/psa/bin/modules/firewall/settings -a
The firewall rules were activated. To save your changes, run the --confirm command within 120 second(s).

/usr/local/psa/bin/modules/firewall/settings -c
Too late to confirm: no rules activation process
Unable to confirm the firewall rules.

exit status 1

Just to be sure did you run the /usr/local/psa/bin/modules/firewall/settings --confirm command to confirm the rule changes?

 

[MariuszB]

Yes, I confirm.

 

[MariuszB]

I wonder why I have message like this:

Too late to confirm: no rules activation process
Unable to confirm the firewall rules.

when in process list is:

/usr/bin/python3 -Estt -IS /usr/local/psa/admin/sbin/modules//firewall/rules --activate --rules-file /usr/local/psa/tmp/ext-firewall-rules-FpT47O

This process works to timeout from panel.ini. Is it process for firewall activation?

 

[Peter Debik]

Have you tried to set long timeout values in panel.ini? For example

[ext-firewall]
confirmTimeout = 120
confirmTimeoutCli = 120

 

[MariuszB]

Yes, timeout do not change anything. I can wait 1 second or 90 second with the same effect.

Maybe problem is in another iptables app like fail2ban? What happens when fail2ban add something to firewall before confirmation?

 

[Liwindo]

Maybe problem is in another iptables app like fail2ban? What happens when fail2ban add something to firewall before confirmation?

That might be a quite good point. I observed the issue on my server that fail2ban got decativated / became unresponsive after changing firewall settings. Bot the fail2ban log had no critical entries. After cleaning the entries in fail2ban everything was fine again. So between both apps seem to be a non-documented dependency.

 

[Peter Debik]

Fail2Ban uses iptables, it is not a replacement for it. Anyway, it would be good if you could test the theory in your case, e.g. disable Fail2Ban, then apply a change to the firewall manually and see if it then works with shorter timeouts.

 

[MariuszB]

It's looks like fail2ban doesn't matter. Is any other log except panel.log where I can see what is doing firewall?

 

[MariuszB]

When I try start manually command: /usr/local/psa/admin/sbin/modules//firewall/rules --activate --rules-file /usr/local/psa/tmp/ext-firewall-rules-KhZNmg

I have error message: Activation token is absent .

This message appears much time before timeout.

 

[Kaspar]

Seem you have quite some bad luck with the Firewall. I suggest contacting Plesk support so they can investigate the issue on your server directly.

 

[MariuszB]

I don't think so is only my bad luck. I have 9 servers with Plesk on CentOS 7, Alma 8 and 9 and all of them with new firewall have this issue.

Sometimes firewall reload correctly but I don't know when. I can't reproduce problem with 100% sure.

 

[Kaspar]

Sorry, that was bad phrasing from my part. With 'bad luck' I meant to acknowledge that you seem to encounter quite some issues with the Firewall. That hasn't got anything to do with 'luck' off course. Obviously something is causing those issues, which could be a multitude of things. Hence my suggestion to contact support for investigation.

 

[Dave W]

You need to run /usr/local/psa/bin/modules/firewall/settings -c is a separate SSH session

you can do this from one session using:

/usr/local/psa/bin/modules/firewall/settings --apply
SSH_CLIENT="127.0.0.1 65533 22" plesk bin modules/firewall/settings --confirm

 

[MariuszB]

This solution doesn't work. I have error message:

Too late to confirm: no rules activation process

Unable to confirm the firewall rules.

exit status 1
exit status 1