Question Question How to allow custom iptables rules in Plesk Obsidian?

[danimora]

Server operating system version

CentOS Linux 7.9.2009 (Core)

Plesk version and microupdate number

Plesk Obsidian Version 18.0.52 Update #3

I need to make a custop iptables rule persistent so that I can enable our docker containers to access Internet.

This is the rule:

iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE

But this rule is lost everytime I make a change using the Plesk Firewall GUI.

How can I make this rule persistent? I've seen post talking about iptables-persistent but that might not apply to Obsidian.

What is the right way to add custom rules?

 

[Kaspar]

Just add it as a custom rule to the Plesk Firewall. See:

https://support.plesk.com/hc/en-us/articles/12377519983511-How-to-manage-local-firewall-rules-using-Plesk-Firewall-in-Plesk-for-Linux

 

[danimora]

Just add it as a custom rule to the Plesk Firewall. See:

https://support.plesk.com/hc/en-us/articles/12377519983511-How-to-manage-local-firewall-rules-using-Plesk-Firewall-in-Plesk-for-Linux

I'm afraid that the custom rule I need to add (NAT, post routing, masquerade) cannot be created using the Plesk Firewall GUI (or at least I don't se how).

 

[Kaspar]

Sorry, you're right. I completely missed those rule settings in your OP. Interesting conundrum ... I don't have any suggestions at moment on how to go about this. Maybe someone else has a suggestion ..

 

[Peter Debik]

Does this page help?

Saving Iptables Firewall Rules Permanently - Thomas-Krenn-Wiki-en

This article explains several ways in which iptables rules can be stored permanently on Linux.

www.thomas-krenn.com

 

[danimora]

Does this page help?

Saving Iptables Firewall Rules Permanently - Thomas-Krenn-Wiki-en

This article explains several ways in which iptables rules can be stored permanently on Linux.

www.thomas-krenn.com

Thank you for the suggestion. This technique looks cool but I'm afraid that if I persist the iptables rules and restore them this would certainly overwrite the iptables rules generated by Plesk.

The Plesk firewall creates a .sh file that rewrites all the iptables config each time it is applied (/usr/local/psa/var/modules/firewall/firewall-active.sh)

 

[scsa20]

My suggestion is to copy the current rules generated by Plesk then turn off/disable the Plesk firewall, then manually apply the rules with your custom rules following the instructions provided by Peter. This does mean that you will not be able to use the Plesk firewall extension but you will have greater control over the firewall.

 

[danimora]

My suggestion is to copy the current rules generated by Plesk then turn off/disable the Plesk firewall, then manually apply the rules with your custom rules following the instructions provided by Peter. This does mean that you will not be able to use the Plesk firewall extension but you will have greater control over the firewall.

Yes, I finally realized that it cannot be done if the Plesk Firewall is enabled. The way you suggest the best one. However I ended up doing it with a cron script because I like to keep all my Plesk servers with a the same manegement procedures.

Thanks!

 

[Johnny9977]

Yes, I finally realized that it cannot be done if the Plesk Firewall is enabled. The way you suggest the best one. However I ended up doing it with a cron script because I like to keep all my Plesk servers with a the same manegement procedures.

Thanks!

Can you please share your solution? I have the same issue and like your aproach.