Plesk 12.5 PSA-Firewall Custom Rules add unnecessary DROP rules.

[paulieG]

Hi,
Testing Plesk 12.5 firewall.

If I create custom rule :


Test Allow incoming from XXX.XXX.XXX.XXX on all ports

Then the following iptables rules are generated :

/sbin/iptables -A INPUT -p udp -s XXX.XXX.XXX.XXX -j ACCEPT
/sbin/iptables -A INPUT -p udp -j DROP
/sbin/iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT
/sbin/iptables -A INPUT -p tcp -j DROP
/sbin/ip6tables -A INPUT -p udp -s ::ffff:XXX.XXX.XXX.XXX -j ACCEPT
/sbin/ip6tables -A INPUT -p udp -j DROP
/sbin/ip6tables -A INPUT -p tcp -s ::ffff:XXX.XXX.XXX.XXX -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp -j DROP


This is is a bit of a problem is it not? When can we see a fix?

Paul.

 

[IgorG]

I can't reproduce this issue on my default test Plesk 12.5 installation.
Could you please provide more detail? Step-by-step instruction for reproducing would be great.

 

[Jlone]

It's happening to iptables too, not just ip6tables. Seems like a bug?

 

[Andrey Sorokin]

Hi.

I have same issue.
When you add custom rules into the firewall, and if in rules present source ip - rules created wrong:
as example from "preview":
/sbin/iptables -A INPUT -p udp -s 40.40.40.40 -j ACCEPT
/sbin/iptables -A INPUT -p udp -j DROP
/sbin/iptables -A INPUT -p tcp -s 40.40.40.40 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -j DROP
/sbin/ip6tables -A INPUT -p udp -s ::ffff:40.40.40.40 -j ACCEPT
/sbin/ip6tables -A INPUT -p udp -j DROP
/sbin/ip6tables -A INPUT -p tcp -s ::ffff:40.40.40.40 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp -j DROP

/sbin/iptables -A INPUT -p tcp --dport 100 -s 50.50.50.50 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 100 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 100 -s ::ffff:50.50.50.50 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 100 -j DROP



I added 2 custom rules:
first: allow tcp 100 from 50.50.50.50
second: allow all from 40.40.40.40

If rules applied - all traffic will block.

Please help us to resolve this issue.

 

[Will-NYESDigital]

This maybe relates : http://talk.plesk.com/threads/plesk-12-5-3-firewall-rule.335315/ We have logged our issue and it has been confirmed as a bug

 

[bekway]

I have a similar related issue on a fresh install exactly the same set up (CentOS 6 Plesk 12.5). Upon adding a custom rule in Plesk firewall (opening passive FTP ports), all connections Pop and Imap via ports 995 and 993 are denied, and despite them being indicated as open using SSH root command openssl s_client -showcerts -connect mail.mydomain.tld:995
I tried adding a custom rule in /etc/sysconfig/iptables and restart but this just blocked all ports
It looks as if iptables (and ip6tables) are not actually started as a service??