How can I use Parallels Virtuozzo's built-in firewall utility (
psa-firewall under the hood apparently
psa-firewall seems to be a seperate Plesk interface - either way, it's basically a UI for limited iptables management) for VPSs to set up a simple rule that denies access to a port for all connections other than certain specified IP addresses?
I had the idea that VZ firewall rules - like the iptables rules that (I believe) they are translated into - were executed in order, top to bottom, and that I could block all but specified IP addresses from accessing my port (in this case, SSH on port 22) by having narrow Allow rules at the of the list, for IP address xx.xx.xx.xx and port 22, then a Reject rule at the end for any IP address and port 22.
The idea was, for requests from the named IP addresses, the Allow rule would be reached, so the Reject rule would never be reached. For everything else, the Allow rule would be ignored, and the reject rule below it would be reached.
But it didn't work out like that. At first, it worked exactly as intended, but ~20 minutes later I was finding myself shut out of SSH and the only way I could get back in was by both deleting the Reject rule and adding a (redundant) Allow all to port 22 rule to the top of the list.
With further testing, it seems like order of rules in the VZ firewall utilty UI does not cleanly dictate order in the resulting configuration. e.g. I'm finding that having an Allow All to 22 rule at the top of the list and a Reject All to 22 at the bottom seems to block all connections, as does exactly the same with the order reversed.
I had a theory that the utility prepends newly activated rules to the list, but it seems like having a reject-all rule always overpowers any accept-one rules regardless of list position or order that they are added.
I can't figure out the pattern, and I can't find any relevant resources on this utility that explain it. I also can't find any other approaches.
The reason I'm using the VZ firewall utility, rather than just using iptables directly, is that I want administrators to be able to update the rules and add whitelisted IP addresses without any danger of them permanently locking themselves out. It's useful to be able to administer SSH access using a tool that doesn't depend itself require SSH access.
p.s. It's very hard to find quality information on the VZ firewall utility. Everywhere I look takes me to either woefully incomplete for-dummies style resources, or, information about configuring iptables directly. I can't find anything on how the UI settings are interpreted behind the scenes or how they relate to existing iptables settings. Any general pointers towards detailed quality information on what's going on behind the scenes of the VZ firewall utility would also be appreciated.