Unable to turn on Plesk Firewall with error: Did not receive a matching activation token before confirmation timeout

Symptoms

• Unable to turn on firewall via Plesk GUI, with error like below:

PLESK_ERROR: Did not receive a matching activation token before confirmation timeout

• Same error records can be found in Plesk log /var/log/plesk/panel.log

• Firewall service shows as active:

  # systemctl status plesk-firewall.service
  ● plesk-firewall.service - Plesk firewall rules
  Loaded: loaded (/usr/lib/systemd/system/plesk-firewall.service; disabled; vendor preset: disabled)
  Active: active (exited) since Mon 2023-05-08 17:22:29 UTC; 37min ago
  Process: 20444 ExecStart=/bin/bash /usr/local/psa/var/modules/firewall/firewall-active.sh (code=exited, status=0/SUCCESS)
  Main PID: 20444 (code=exited, status=0/SUCCESS)

• Firewall rules with no from nor ports are seen in json configuration:

  # /usr/local/psa/bin/modules/firewall/settings --list-json
  [
  ....
  ....
  {
  "class": "custom",
  "name": "block 203.0.113.2",
  "direction": "input",
  "ports": "",
  "from": "",
  "action": "deny",
  "originalId": 98,
  "id": 478
  },
  {
  "class": "custom",
  "name": "block 203.0.113.3",
  "direction": "input",
  "ports": "",
  "from": "",
  "action": "deny",
  "originalId": 97,
  "id": 477
  },
  ....
  ....

Cause

Misconfigured rules are present in Plesk Firewall. Fields ports and from are empty.

Resolution

Remove misconfigured rules manually:

1. Connect to the server via SSH

2. Backup firewall database by running

   # cp -p /usr/local/psa/var/modules/firewall/firewall.sqlite3 /root/firewall_backup.sqlite3

3. Open the firewall database with sqlite3:

   # sqlite3 /usr/local/psa/var/modules/firewall/firewall.sqlite3

4. Use SQL query like below to remove misconfigured firewall rules:

   MYSQL_LIN: DELETE FROM rules WHERE data LIKE "%block 203.0.113.2%"

   MYSQL_LIN: DELETE FROM rules WHERE data LIKE "%block 203.0.113.3%"

   Note: Modify the query accordingly to remove rules in bulk.

5. Start firewall from Tools & Settings > Firewall

Note: Alternatively, in case non of those rules are necessary, reinstall Plesk Firewall. Rules will be deleted. Use Plesk Installer to uninstall & install Plesk Firewall.