How can I use Parallels Virtuozzo's built-in firewall utility (called psa-firewall under the hood apparently actually psa-firewall seems to be a seperate Plesk interface - either way, it's basically a UI for limited iptables management) for VPSs to set up a simple rule that denies access to a port for all connections other than certain specified IP addresses?

I had the idea that VZ firewall rules - like the iptables rules that (I believe) they are translated into - were executed in order, top to bottom, and that I could block all but specified IP addresses from accessing my port (in this case, SSH on port 22) by having narrow Allow rules at the of the list, for IP address xx.xx.xx.xx and port 22, then a Reject rule at the end for any IP address and port 22.

The idea was, for requests from the named IP addresses, the Allow rule would be reached, so the Reject rule would never be reached. For everything else, the Allow rule would be ignored, and the reject rule below it would be reached.

But it didn't work out like that. At first, it worked exactly as intended, but ~20 minutes later I was finding myself shut out of SSH and the only way I could get back in was by both deleting the Reject rule and adding a (redundant) Allow all to port 22 rule to the top of the list.

With further testing, it seems like order of rules in the VZ firewall utilty UI does not cleanly dictate order in the resulting configuration. e.g. I'm finding that having an Allow All to 22 rule at the top of the list and a Reject All to 22 at the bottom seems to block all connections, as does exactly the same with the order reversed.

I had a theory that the utility prepends newly activated rules to the list, but it seems like having a reject-all rule always overpowers any accept-one rules regardless of list position or order that they are added.

I can't figure out the pattern, and I can't find any relevant resources on this utility that explain it. I also can't find any other approaches.

The reason I'm using the VZ firewall utility, rather than just using iptables directly, is that I want administrators to be able to update the rules and add whitelisted IP addresses without any danger of them permanently locking themselves out. It's useful to be able to administer SSH access using a tool that doesn't depend itself require SSH access.

p.s. It's very hard to find quality information on the VZ firewall utility. Everywhere I look takes me to either woefully incomplete for-dummies style resources, or, information about configuring iptables directly. I can't find anything on how the UI settings are interpreted behind the scenes or how they relate to existing iptables settings. Any general pointers towards detailed quality information on what's going on behind the scenes of the VZ firewall utility would also be appreciated.

  • If this is a serverfault.com question feel free to migrate it, but the impression I get is those guys flame any questions about anything with a UI. – user56reinstatemonica8 Apr 7 '13 at 22:44

This is simply my best theory so far from testing. It seems like:

  • On changes, the VZ firewall utility runs a lookup for the existing rule, removes it, and adds a new rule, rather than resetting rules. It seems like this might not be 100% reliable and that it's possible to edit rules and end up with a 'ghost rule' that stays until IPtables is reset.
  • It seems like the utility periodically flushes and re-runs the rules (plus any coded in /etc/firewall/include).
  • It seems like the rules configured using the utility UI are included in order, and do behave as I expected - unless there is one of these 'ghost rules' behind the scenes.

If this is true, if anyone finds themselves in the situation I was in, you should be able to VZ's firewall to behave rationally again by using VZ to restart the iptables 'service' in 'System services'. Add a temprorary allow rule to the top of the chain if it claims it's not able to restart the service.

(be wary of using iptables -F to flush the iptables rules, as this seems to flushes everything including the rules that grant VZ utilities appropriate access. The system restart tool refreshes iptables with everything including VZ's under-the-hood config, your host's config, rules configured in the utility, and custom rules in /etc/firewall/include. iptables -F does not. If it's set to reject or drop by default, you might completely lock yourself out)

Edit: This clearly isn't all there is to it... Suddenly, the VZ firewall utility has started having no effect at all on the underlying iptables rules, and using iptables -n -L INPUT|grep dpt:22 to list all iptables rules that specify port dport 22, I see lots of old junk rules that have since been removed that aren't removed on restart, even after flushing iptables then restarting the service. Reading http://www.webhostingtalk.com/showthread.php?t=1166215 suggests that the VZ firewall also has a database of rules that can get out of sync with the code and the UI... but offers no clue about how to access this database.

Edit 2: It seems like something caused iptables and the Virtuozzo firewall to start simply reading from the file /etc/sysconfig/iptables rather than regenerating properly. The clunky fix I found for this was essentially, to rename the files /etc/sysconfig/iptables and /etc/sysconfig/iptables.save as backups, then use VZ Firewall Setup to reset the firewalls completely, which generated empty iptables files, then restarted the iptables service - after doing all this, settings in the VZ firewall utility began to have their predicted effects.

Curiously, after doing the above, the iptables chains have names like VZ_INPUT instead of INPUT, so to list the iptables rules for a port, I need to use iptables -n -L|grep dpt:22 or iptables -n -L VZ_INPUT|grep dpt:22 instead of iptables -n -L INPUT|grep dpt:22. Odd.

Hopefully if someone else ends up stuck with a misbehaving Virtuozzo firewall service, something here will help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.