Firewall will not activate

[JasonJ]

I have installed the firewall on Plesk 8.6 (CentOS VPS, 34SP hosting) and it will not activate.

On its default settings, activation results in the following error message:

Error: Could not activate firewall configuration:
safeact: safeact: /usr/local/psa/var/modules/firewall/firewall-new.sh failed:
iptables: No chain/target/match by that name

It also gives this message, but I don't this one is the main problem:

proc_close() failed: mktime() [<a href='function.mktime'>function.mktime</a>]: It is not safe to rely on the system's timezone settings. Please use the date.timezone setting, the TZ environment variable or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/London' for 'BST/1.0/DST' instead

If I run the activation script directly, it gets part way through, issues the same "iptables: No chain/target/match by that name" error, then locks all network traffic on the server. A reboot is the only way to get the server back online.

Other information: lsmod gives me nothing - no modules shown at all. I don't know what that means.

The following line from the activation script gives me the same error message:

[root@www log]# /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name

My guess is something to do with the 'state' module, perhaps because it is built into the kernel and is not a module? Don't know - I'm mostly guessing there.

Any ideas what I need to do to fix this problem? I have seen firewall activation errors raised going back nine months, with no fixes in sight, so I don't hold up much hope, but I am keeping my fingers crossed.

Any clues?

-- Jason

 

[Denis Sirochenko]

Hello Jason,

Take a look at the following Knowledge Base article:

"No chain/target/match by that name" error occurs during Plesk firewall settings activating.
http://kb.odin.com/en/4020

Regards,
Denis.

 

[JasonJ]

That article leads to this as a solution:

http://kb.odin.com/en/746

I assume this is something my web hosting company would need to do? I'm just a poor client stuck in the VPS ;-)

-- Jason

 

[Maa]

Waaa....
Firewalls are scary...

kb seems, however, quite reasonable - having no modules is typical for VE.
You have no way of correcting this yourself, it can only be done from the Virtuozzo node.

 

[JasonJ]

You have no way of correcting this yourself, it can only be done from the Virtuozzo node.

Thanks. That is all I needed to know.

I have asked the hosting company whether this is something they have overlooked for this hardware node, or something they simply do not support, or something they are willing to add. To my mind, if they supply Plesk as a part of the hosting, then it should include the modules that come with Plesk, even if they are optional.

I realise the Plesk firewall is not very sophisticated, but it is a start, and it is a safe environment to set up rules without locking myself out of the server doing iptables by hand constantly gets me locked out, requiring a reboot.

The other option is to edit the firewall script and remove the lines with the 'state' module before it is activated. I don't know what effect that would have - perhaps just on a service I don't use, such as VPN - I really don't know.

-- Jason

 

[JasonJ]

The hosting company are moving my VPS to another hardware node, with the modules enabled, so that should sort me out

-- Jason