Issue Failed to apply the firewall configuration - [ext-firewall] set to 40 seconds

[Peter Debik]

Thank you for your feedback. We'll sure have a look at this.

 

[epertinez]

Trying to apply changes to configuration totally halts the server to the extend that I have to ask for a hard reset to my host provider.
Changes are quite easy. Simply adding some countries to the banning list following Plesk documentation. Nothing fancy.
The first time I tried to update the rules, I checked them one by one against the "original" (no country added yet, simple vanilla rules). They were exatcly the same and even then they totally blocked the server.
NOW... I have some 15K deny rules on one of the nginx configurations... could it be it? Do you know if nginx deny rules are applied through inserting them into iptables? I could erase those rules if that is the case, as those rules are simply specific filters for IPs of the same countries that now I wanna ban through Firewall.
Curiously enough.... when I edit and apply the nginx rules through plesk interface, it does not take long...

UPDATE: As a clue...

iptables -L -n
Another app is currently holding the xtables lock; still -9s 0us time ahead to have a chance to grab the lock...
Another app is currently holding the xtables lock; still -19s 0us time ahead to have a chance to grab the lock...
Another app is currently holding the xtables lock; still -29s 0us time ahead to have a chance to grab the lock...
Another app is currently holding the xtables lock; still -39s 0us time ahead to have a chance to grab the lock...
Another app is currently holding the xtables lock; still -49s 0us time ahead to have a chance to grab the lock...

...and then it starts showing results...
Chain INPUT (policy DROP)
...

 

[Peter Debik]

Also discussed in separate thread Issue - NGinx deny rules and Firewall (iptables?)

NOW... I have some 15K deny rules on one of the nginx configurations... could it be it?

Yes, absolutely. Way too many.

Do you know if nginx deny rules are applied through inserting them into iptables?

No, these are placed in a webserver configuration file. It will cause Nginx to take "forever" to restart.

This does not mean that besides that issue other issues exist regarding iptables on your server.

Please also make sure that firewalld is disabled or removed from your system. Running both, Plesk firewall AND firewalld, can create a deadlock situation as described by you.