Forwarded to devs Firewall ignores some rules

[andre.spindler]

TITLE:

Firewall ignores some rules​

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE:

Plesk Onyx Version 17.5.3 Update #41
CentOS Linux 7.4.1708 (Core)‬​

PROBLEM DESCRIPTION:

There is a set of about 300 firewall rules defined in the plesk firewall module.
If I check the iptables setup. The about 10 rules at the top are missing. iptables output starts with the entry at position 11.

Looks like an undocumented limitation.​

STEPS TO REPRODUCE:

Define a lot of firewall rules and activate them.
On shell check output of iftables:
# iptables -L > iptables​

ACTUAL RESULT:

The newest rules at the top of the firewall rule list are missing.​

EXPECTED RESULT:

All rules are included in the iptables output.​

ANY ADDITIONAL INFORMATION:

​

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM:

Confirm bug​

 

[IgorG]

From Plesk developer:

Cannot reproduce by provided steps.
I've created 332 rules in Plesk firewall, applied changes and all of them were correctly added to iptables.
Need more information from customer, i.e.

• Exact steps to reproduce (did not he forget to "Apply changes").
• List of rules in firewall UI
• Output from iptables -L.

 

[andre.spindler]

It seems like the complete firewall bahaviour is very strange, not to say weird.
For now I have 307 custom rules and the default rulkes of the firewall module enabled. Altogether 332 rules are defined.
But there are many rules including more than one ip range. I've counted the ip ranges and got a total number of 1983. All user defined rules and ip ranges are set for both udp and tcp, so this shopuld result in about 3950 single entries in iptables.
But when doing a # iptables -L > iptables, the current output file has just 1978 lines.
And even more strange: If I execute several dumps of iptables, the dump files have different sizes.
First result was 640kB, after rebooting the server the size was about 130kB.
Switching to edit mode in Plesk WebUI and activating the same configuration resulted in a file with 256kB.
The last operation in Plesk was to disable fw management and enable it again, now the dump size is about 126kB. With 1978 lines mentioned above.

What might be the reason for this strange behaviour of the firewall module and iptables?