• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Plesk automated iptables configuration security issue?!

S

schlimpf

Basic Pleskian
Hello there,

I am currently configuring my iptables firewall and wanted to do that with the integrated interface in Plesk Panel.
When I was testing the configuration, I found out that the preset configuration of input/output traffic in Plesk is pretty much useless?!

When I choose to block all these connections by default, Plesk generates this script:

#!/bin/sh
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.

set -e

echo 0 > /proc/sys/net/ipv4/ip_forward
([ -f /var/lock/subsys/ipchains ] && /etc/init.d/ipchains stop) >/dev/null 2>&1 || true
(rmmod ipchains) >/dev/null 2>&1 || true
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A FORWARD -i lo -o lo -j ACCEPT
/sbin/iptables -t mangle -F
/sbin/iptables -t mangle -X
/sbin/iptables -t mangle -Z
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
/sbin/ip6tables -F
/sbin/ip6tables -X
/sbin/ip6tables -Z
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
/sbin/ip6tables -A INPUT -m state --state INVALID -j DROP
/sbin/ip6tables -P OUTPUT DROP
/sbin/ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/ip6tables -A OUTPUT -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
/sbin/ip6tables -A OUTPUT -m state --state INVALID -j DROP
/sbin/ip6tables -P FORWARD DROP
/sbin/ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/ip6tables -A FORWARD -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
/sbin/ip6tables -A FORWARD -m state --state INVALID -j DROP
/sbin/ip6tables -A INPUT -i lo -j ACCEPT
/sbin/ip6tables -A OUTPUT -o lo -j ACCEPT
/sbin/ip6tables -A FORWARD -i lo -o lo -j ACCEPT
/sbin/ip6tables -t mangle -F
/sbin/ip6tables -t mangle -X
/sbin/ip6tables -t mangle -Z
/sbin/ip6tables -t mangle -P PREROUTING ACCEPT
/sbin/ip6tables -t mangle -P OUTPUT ACCEPT
/sbin/ip6tables -t mangle -P INPUT ACCEPT
/sbin/ip6tables -t mangle -P FORWARD ACCEPT
/sbin/ip6tables -t mangle -P POSTROUTING ACCEPT
/sbin/iptables -t nat -F
/sbin/iptables -t nat -X
/sbin/iptables -t nat -Z
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 12443 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 12443 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 11443 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 11444 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 11443 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 11444 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 8447 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 8447 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 8880 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 8443 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 8880 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 21 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 587 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 587 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 465 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 25 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 465 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 995 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 110 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 995 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 143 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 993 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 143 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 993 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 106 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 106 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 3306 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 3306 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 5432 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 5432 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 9008 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 9080 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 9008 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 9080 -j DROP

/sbin/iptables -A INPUT -p udp --dport 137 -j DROP
/sbin/iptables -A INPUT -p udp --dport 138 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 139 -j DROP
/sbin/iptables -A INPUT -p tcp --dport 445 -j DROP
/sbin/ip6tables -A INPUT -p udp --dport 137 -j DROP
/sbin/ip6tables -A INPUT -p udp --dport 138 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 139 -j DROP
/sbin/ip6tables -A INPUT -p tcp --dport 445 -j DROP

/sbin/iptables -A INPUT -p udp --dport 1194 -j DROP
/sbin/ip6tables -A INPUT -p udp --dport 1194 -j DROP

/sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT
/sbin/ip6tables -A INPUT -p udp --dport 53 -j ACCEPT
/sbin/ip6tables -A INPUT -p tcp --dport 53 -j ACCEPT

/sbin/iptables -A INPUT -p udp -j ACCEPT
/sbin/iptables -A INPUT -p tcp -j ACCEPT
/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 134/0 -j ACCEPT
/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 135/0 -j ACCEPT
/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 136/0 -j ACCEPT
/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 137/0 -j ACCEPT

/sbin/iptables -A INPUT -p icmp --icmp-type 8/0 -j ACCEPT
/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 128/0 -j ACCEPT
/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 129/0 -j ACCEPT

/sbin/iptables -A INPUT -j DROP
/sbin/ip6tables -A INPUT -j DROP

/sbin/iptables -A OUTPUT -j DROP
/sbin/ip6tables -A OUTPUT -j DROP

/sbin/iptables -A FORWARD -j DROP
/sbin/ip6tables -A FORWARD -j DROP

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /opt/psa/var/modules/firewall/ip_forward.active
chmod 644 /opt/psa/var/modules/firewall/ip_forward.active
#
# End of script
#
Click to expand...

The highlighted lines make the default "DROP" which I configured in the Panel useless, at least for tcp/udp connections for any other ports which are not explicitly configured.

Please tell me how to remove these highlighted lines..

Regards,
schlimpf

Edit: Used qoute-Tag instead of code for highlighting
 
I found out that these two rules come from

"IPv6 Neighbor Discovery"

If I deny this rule, the two mentioned lines will become
Code: 
/sbin/iptables -A INPUT -p udp -j DROP
/sbin/iptables -A INPUT -p tcp -j DROP

This is definitely a bug.


Edit: This is still wrong because it now overwrites previous rules. There must be a port missing in the IPv6 Neighbor Discovery

Edit2: see also http://forum.parallels.com/showthread.php?t=246087
and http://forums.serverbeach.com/showthread.php?6291-passive-FTP-and-firewall-issue
and http://forum.parallels.com/showthread.php?t=210439

It makes the firewall function pretty much useless with the wrong configuration
 
Last edited:
On a dev server, I would recommend a more better firewall app like CSF (ConfigServer) or APF.
 
You must log in or register to reply here.

Similar threads

Liwindo
Input New Firewall App 18.0.52
Replies
4
Views
830
Liwindo
Liwindo
E
Issue IPv6 - unreachable domain
Replies
6
Views
1K
mow
M
Sailorhost
Question IPv6 unreachable
Replies
4
Views
1K
Sailorhost
Sailorhost
ChrisMonder
Question How to ignore/block POP3/IMAP login attempts for a non existent domain in my server?
Replies
4
Views
2K
ChrisMonder
ChrisMonder
T
Issue Can't Update Plesk Firewall
Replies
2
Views
1K
brother4
brother4
Back
Top