allow update with iptables with deny approach

[ArmandoC]

Hi everybody, i have configured my iptables to allow connections for a few known ip addresses...
What should I do to allow plesk update??
thanks

 

[Nikolay.]

Hi everybody, i have configured my iptables to allow connections for a few known ip addresses...
What should I do to allow plesk update??
thanks

You should allow access to autoinstall.plesk.com and any servers listed in your system package manager repositories configuration. Also don't forget to allow access to Plesk licensing server. IIRC, autoinstall.plesk.com points to CDN, so IP address may vary.

 

[ArmandoC]

so, i should do something like this?
iptables -A INPUT -s autoinstall.plesk.com -j ALLOW
iptables -A INPUT -s ka.parallels.com -j ALLOW

iptables -A INPUT -s repository_1 -j ALLOW
iptables -A INPUT -s repository_2 -j ALLOW
...

 

[Nikolay.]

so, i should do something like this?
iptables -A INPUT -s autoinstall.plesk.com -j ALLOW
iptables -A INPUT -s ka.parallels.com -j ALLOW

iptables -A INPUT -s repository_1 -j ALLOW
iptables -A INPUT -s repository_2 -j ALLOW
...

Kind of, yes. Though you should probably use OUTPUT chain, so it looks like:

iptables -A OUTPUT -d autoinstall.plesk.com -j ACCEPT

This kind of rule would suffice provided you accept established connections as well.

Let me quote iptables(8) man page: "Address can be either a network name, a hostname (please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea), ...".

Also I advise to try out Plesk firewall extension for managing firewall configuration.

 

[ArmandoC]

if i use plesk's firewall, is there no need to allow plesk server? there are string for them...
for the repository?

and last question, is possible configure plesk firewall to filter mac address?

 

[Nikolay.]

if i use plesk's firewall, is there no need to allow plesk server? there are string for them...
for the repository?

and last question, is possible configure plesk firewall to filter mac address?

Yes, you will need to manually allow any external servers since default Plesk firewall module policy for OUTPUT is to ACCEPT.

No, it doesn't allow to filter by MAC addresses.

 

[ArmandoC]

I have seen the plesk's firewall (work on iptables)...to block all ip and allow only same ip i should block the www and allow the ip?

how can i block all the access in apache (like head, error....) with plesk firewall?

Thanks