0

I am running a vServer with Ubuntu 10.04 LTS and Plesk 12. I am using the Plesk firewall module which was ok for me so far. However, now I set up a OpenVPN server on the server. In order to be able to route traffic over the VPN to the outside, I need to add the NAT rule to iptables:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE 

The problem is that the Plesk firewall module creates an own set of iptables rulles and in Plesk itself I cannot add this specific rule. So I am looking for any way to make my rule permantent in a way that it will not be overwritten whenever Plesk runs its script. I was thinking of some kind to script that can be automatically executed after Plesk updates iptables or something similar.

I have also looked in the SQL database but the psa table for the firewall module seems to store the allow/deny rules in some custom format. Any help is much appreciated!

1
  • Administration panels are off topic. – HopelessN00b Feb 24 '15 at 3:54
3

TL;DR

You can't / shouldn't.

Okay fine I'll explain more...

Anything that you do outside of Plesk's prescribed way of handling things will break it and knock it out of a supported state. I've been there, done that and have the broken customer VPSs to prove it (as well as impassioned crying on Plesk's support forums as everlasting proof of my shame). Your best bet is to contact Plesk support and see if there's some supported method that is poorly document (or not documented, as the case may be). Furthermore, expect it to break on your next update.

If you want to do anything like this that is outside of Plesk's pre-defined set of rules and regulations, you need to sysadmin up and start managing servers without Plesk. If your customers / clients whine, find new ones or tell them they can't do certain things that are needful for the scenario.

I have also looked in the SQL database but the psa table for the firewall module seems to store the allow/deny rules in some custom format. Any help is much appreciated!

And that's why Plesk is awful. Or... one of the reasons Plesk is awful. One of about elebenty billion.

An actual answer

Having dealt with things like this in the past, you'll probably need to create a script in your favorite language that checks the iptables rules for the existence of the rule you want, and then insert it if it's not present. Cron it up every few minutes, then sit back and wait for the mayhem.

3
  • thanks, your actual answers goes in the direction I was looking for. One question though: How to check for the existence of the NAT rule in iptables? Any of the solutions I just found worked only for allow/reject/forward rules – silent Dec 26 '14 at 22:36
  • @silent That would be a separate question, and probably not one that ServerFault as a culture would smile on. It's a general concept that would involve basic scripting skills to pipe iptables -L output into a loop to find what you want and confirm or deny its existence and then do something based on what the loop finds. – Wesley Dec 26 '14 at 22:39
  • ok. Just figured there might be a simple answer ;-) I wasn't looking for the scripting - I can manage this part - only whether I can do this in the first place – silent Dec 26 '14 at 22:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.