Resolved Plesk Firewall [Do I have to open all ports when switching from another firewall to Plesk Firewall?]

[othmaqsa]

Server operating system version

Version 18.0.52

Plesk version and microupdate number

Ubuntu 20.04.6 LTS

Hello,

If I I want to use the Plesk Firewall instead of Ionos Firewall, I need to open all ports in Plesk Firewall before remove them from Ionos ?

Note: I want to switch to Plesk Firewall so that I can use the feature of denying countries.

 

[MarkM]

Sounds like you're going from a network firewall, to a server level firewall. They can work in tandem if you want.

I would close what ports are not needed within the Plesk Firewall, before disabling the old one.

 

[Peter Debik]

I would not recommend opening anything that you have in your data center firewall. Why not leave ports closed there so that some bad traffic cannot reach your server in the first place. The Plesk Firewall is the on-server firewall that you'd normally use in addition to the data center firewall (as @MarkM correctly pointed out). Using both will give you extra security. It is not necessary to disable your data center firewall when you want to use the Plesk Firewall.

 

[othmaqsa]

I would not recommend opening anything that you have in your data center firewall. Why not leave ports closed there so that some bad traffic cannot reach your server in the first place. The Plesk Firewall is the on-server firewall that you'd normally use in addition to the data center firewall (as @MarkM correctly pointed out). Using both will give you extra security. It is not necessary to disable your data center firewall when you want to use the Plesk Firewall.

Ok, so if I understood correctly, I can install Firewall Plesk and use the feature of blocking countries while leaving the ports disabled on Firewall Plesk and enabled on Firewall IONOS?

 

[othmaqsa]

Sounds like you're going from a network firewall, to a server level firewall. They can work in tandem if you want.

I would close what ports are not needed within the Plesk Firewall, before disabling the old one.

Ok, thank you.

 

[othmaqsa]

Hello,

I can see now in this url https://support.plesk.com/hc/en-us/...r-whitelist-specific-countries-through-Plesk- , that I can block a country, using directly the Firewall.

Can I use the Firewall to block country for incoming traffic for the Webmail or it will work only with the Websites ?

Thank you.

 

[Peter Debik]

When you do not enter a specific port, the block applies to all ports. This includes the web service and mail ports.

 

[othmaqsa]

Hello @Peter Debik

Thank you for your message.

I have installed the Firewall. Now before enabling the Firewall in Plesk, I want to disable all the default rules and add 1 custom rule (Deny country).

Note: I want to deactivate the default rules because the same rules are already open in the Data Center Firewall.

 

[othmaqsa]

Sounds like you're going from a network firewall, to a server level firewall. They can work in tandem if you want.

I would close what ports are not needed within the Plesk Firewall, before disabling the old one.

When you do not enter a specific port, the block applies to all ports. This includes the web service and mail ports.

Thank you guys.

You can now mark this thread as resolved.

 

[z72diego]

When you do not enter a specific port, the block applies to all ports. This includes the web service and mail ports.

Hello guys.

I just enabled country block using Workaround II but i still receiving e-mails from Russia for example, which is correctly blocked (tested with VPN) for nginx. Mail server keeps receiving spam from domain names associated to IP addresses from RU.

Any idea?
Thanks

 

[Peter Debik]

Are these mails really sent from an IP address in the blocked range? Or are they coming from another SMTP server outside the range?

 

[othmaqsa]

Maybe because the Workaround II, it only blocks the access to the Website, not mail.

You must use the Plesk firewall.

Hello guys.

I just enabled country block using Workaround II but i still receiving e-mails from Russia for example, which is correctly blocked (tested with VPN) for nginx. Mail server keeps receiving spam from domain names associated to IP addresses from RU.

Any idea?
Thanks

 

[z72diego]

Are these mails really sent from an IP address in the blocked range? Or are they coming from another SMTP server outside the range?

For example, today I received an e-mail from this address: [email protected]

Check this header:
spf=pass (sender IP is 188.127.251.135) smtp.mailfrom=[email protected] smtp.helo=mail4.srnart-gas.com

This IP is from Russia: 188.127.251.135 IP Address Geolocation Lookup Demo | IP2Location

You must use the Plesk firewall.

Ok, but how?

Thanks!

 

[z72diego]

Maybe because the Workaround II, it only blocks the access to the Website, not mail.

You must use the Plesk firewall.

Workaround I it's not available anymore: Deny-country

 

[othmaqsa]

Ok, but how?

Thanks!

To install the Plesk Firewall, take a look here: https://support.plesk.com/hc/en-us/articles/12377540171799-How-to-install-Plesk-Firewall

To block a country through the Plesk Firewall, take a look here:

https://support.plesk.com/hc/en-us/articles/12377285410839-How-to-block-or-whitelist-specific-countries-through-Plesk-

 

[othmaqsa]

Workaround I it's not available anymore: Deny-country

You need to use the Plesk Firewall.

Yes, the Workaround I is not available anymore, as the extension is not available anymore.

For more information regarding the Plesk Firewall: (Plesk for Linux) The Plesk Firewall

 

[z72diego]

To install the Plesk Firewall, take a look here: https://support.plesk.com/hc/en-us/articles/12377540171799-How-to-install-Plesk-Firewall

To block a country through the Plesk Firewall, take a look here:

https://support.plesk.com/hc/en-us/articles/12377285410839-How-to-block-or-whitelist-specific-countries-through-Plesk-

I already did this block (workaround II): https://support.plesk.com/hc/en-us/...r-whitelist-specific-countries-through-Plesk-

 

[othmaqsa]

I already did this block (workaround II): https://support.plesk.com/hc/en-us/...r-whitelist-specific-countries-through-Plesk-

The Workaround II work only for Websites, not email.

 

[z72diego]

The Workaround II work only for Websites, not email.

Ok thanks. But, how do I country block smtp/imap/pop3 requests at server level? Or better, block all ports and services.

 

[othmaqsa]

Ok thanks. But, how do I country block smtp/imap/pop3 requests at server level? Or better, block all ports and services.

With the Plesk firewall, you can block a bunch of countries using the ISO 3166 country codes , all ports (incoming) and place the deny rule at the top.

This way, you will block incoming traffic for the websites and email.