Issue Plesk Firewall doesn't work !!

[xx1Andy1xxx]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

Plesk Obsidian

Ubuntu 22.04 & Plesk Obsidian = Not Good

Plesk Firewall does not work ...

Every Article in this Forum does not work to enable the Plesk Firewall - Only Errors

A new Ubuntu 22.04 & Plesk Obsidian installation and nothing works anymore. This software is not worth a penny anymore !!
Command '['/usr/local/psa/var/modules/firewall/firewall-new.sh']' timed out after 14.997228860855103 seconds

Mailserver Errors ....

 

[Peter Debik]

Hi @xx1Andy1xxx, sorry to read that the firewall extension is causing trouble. Just today I had fit 20 production servers with a 5 digit number of domains on them with the new firewall extension and as I read a lot on our forum about it I expected trouble, too, - but it all worked like a charm. So I did not experience the same with the latest version of the firewall extension. So maybe we can find a solution for your server, too?

Please first make sure that you have the latest version of the Plesk Firewall extension and the latest version of Plesk. Your version is not mentioned in the post above, but it should be 18.0.53 with update #2. Your Firewall extension should be version 2.1.1-397. Can you confirm that this is the case?

I see that your attempt timed out barely <15 seconds. Have you considered to give the system a bit more time, e.g. 90 seconds? You could for example try this in your panel.ini file:

[ext-firewall]
confirmTimeout = 90 ; the timeout in seconds before the configuration is rolled back
confirmTimeoutCli = 180 ; the timeout in seconds for the --confirm CLI command

 

[xx1Andy1xxx]

That's the Answer of the Firewall:

Did not receive a matching activation token before confirmation timeout

 

[xx1Andy1xxx]

And another Error:

JSON.parse: unexpected character at line 1 column 1 of the JSON data

 

[xx1Andy1xxx]

And another Error:

Command '['/usr/local/psa/var/modules/firewall/firewall-emergency.sh']' timed out after 5 seconds

with this Config in panel.ini

[ext-firewall]
confirmTimeout = 90 ; the timeout in seconds before the configuration is rolled back
confirmTimeoutCli = 180 ; the timeout in seconds for the --confirm CLI command

 

[xx1Andy1xxx]

And the next Error:

I did not receive connectivity confirmation after applying new firewall configuration, then same happened after I reverted to previous configuration. This means that both new and previous configurations were bad. Emergency rollback to configuration without rules was performed. Firewall is now disabled. Fix your rules and try again. And the Rules "ARE FROM PLESK" !!!

 

[xx1Andy1xxx]

And the next Error:

Network Error !!!

And now you can kick the system into the bin !!

NOW MONEY FOR PLESK !!! IT'S BULLSHIT !!!

 

[scsa20]

First the plesk firewall extension is a free extension.

Second, please try to keep everything into one message if all possible.

Third, please refer to the following article for a workaround: https://support.plesk.com/hc/en-us/...ion-after-applying-new-firewall-configuration

 

[Peter Debik]

@xx1Andy1xxx, did you configure any custom rules in Firewall before? I am asking, because it makes no sense that the firewall cannot be started when it comes out of the box, because then you'd not be in the situation where you need to restart it. It only makes sense if custom rules have been added. In that case, either "from" or "ports" fields have been left empty. You could try to fix the situation by removing the extension from the Extensions menu, then reinstalling it. It will then only install the Plesk default ruleset which should work out of the box.

 

[Dave W]

The problem with the firewall extension is the apply and confirm procedure, its not consistent.

And good luck doing it from CLI.

Can this --confirm requirement before rolling back to a previous config or an emergency configuration be disabled. I mean I know its a protection thing incase you lock yourself out of a server but c'mon thats on the user.

 

[Peter Debik]

One reason for this not to work can also be a special configuration setting in panel.ini:

[task]
syncExecution=true

That must not be there, else applying the rules will probably fail. It is not there by default, but it seems that some users have this setting in their panel.ini file, and these are experiencing issues with firewall rules. Reference EXTPLESK-4798.

 

[Dave W]

Can we merge this thread with Issue - Can't confirm firewall rules from CLI ?

 

[Peter Debik]

Unfortunately, threads cannot be merged as such a feature does not exist in the board software.