Articles in this section

See more

Plesk Firewall can not be enabled in Plesk 18.0.52 and newer: I did not receive connectivity confirmation after applying new firewall configuration

Avatar
Gabriel Aznarez
Updated
Follow
Plesk for Linux kb: technical

Symptoms

  • Plesk Firewall can not be enabled with one of the following errors:

    PLESK_ERROR: The firewall configuration has failed.
    I did not receive connectivity confirmation after applying new firewall configuration, then same happened after I reverted to previous configuration. This means that both new and previous configurations were bad. Emergency rollback to the configuration without rules was performed. Firewall is now disabled. Fix your rules and try again.

    PLESK_ERROR: The firewall configuration has failed.
    Command '['/usr/local/psa/var/modules/firewall/firewall-emergency.sh']' timed out after 5 seconds

  • In some cases nginx restarts for quite a long time, for example:

    # time plesk sbin pleskrc nginx try-restart
    real 0m12.762s
    user 0m0.076s
    sys 0m0.052s

  • Or Iptables is operating slow and cause the following command to take long time:

    # time /usr/local/psa/var/modules/firewall/firewall-new.sh
    real 0m25,584s
    user 0m0,294s
    sys 0m0,858s

Cause

Product issue:

  • #EXTPLESK-4587 "Firewall may fail to apply configuration if nginx restart takes too much time"
    Fixed in:

Resolution

  1. Update the Plesk Firewall extension to the version 2.0.2 or higher.

  2. Extend the confirmation timeout by adding the following lines to the end of panel.ini file with this instructions:

    CONFIG_TEXT: [ext-firewall]
    confirmTimeout = 15 ; the timeout in seconds before the configuration is rolled back
    confirmTimeoutCli = 60 ; the timeout in seconds for the --confirm CLI command

Workaround

If an update is not possible for some reason try the following workaround:

workaround

  1. Connect to the server via SSH.

  2. Edit the file /usr/local/psa/admin/sbin/modules/firewall/rules and set DEFAULT_CONFIRM_INTERVAL to 30:

    # grep DEFAULT_CONFIRM_INTERVAL /usr/local/psa/admin/sbin/modules/firewall/rules
    DEFAULT_CONFIRM_INTERVAL = 30

Comments

5 comments

Sort by Date Votes
  • Avatar
    Peter Kielbasiewicz

    My extensions are set to automatic update and all my extensions are shown up-to-date but the problem still exists.

    2
    Comment actions Permalink
  • Avatar
    Peter Kielbasiewicz

    After I tried to run a very simple change to my firewall config my server stalled and it is now not accessible anymore (neither from the web GUI nor from SSH).

    What is going on here?

    Please supply a fix for this problem immediately

    1
    Comment actions Permalink
  • Avatar
    Unknown User

    After this last update, When I modify and apply changes I get "Load Failed" and then a "Failed to apple the firewall configuration." error. With the details of:

    • I did not receive connectivity confirmation after applying new firewall configuration, then same happened after I reverted to previous configuration. This means that both new and previous configurations were bad. Emergency rollback to configuration without rules was performed. Firewall is now disabled. Fix your rules and try again."
    3
    Comment actions Permalink
  • Avatar
    Jeroen Blankestijn

    @Unkown User, Have you ever figured out how to overcome your issue? Having the exact same and getting no where with Plesk support as "They can't replicate on their servers"...

    0
    Comment actions Permalink
  • Avatar
    Unknown User

    Jeroen Blankestijn Not really. It still happens. But it seems to only do it half the time now. Typically if I just re-apply again after the fail it finally goes through. It sounds silly, but if I preview the changes (option it gives) then apply after that, it seems to go through every time. 

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles