Firewall module operation algorithm

Firewall module is designed to manage filtering of incoming network traffic to the server. Filtering is performed through the operating system where the control panel is installed.

Network traffic is processed according to specified rules. For example, you can allow connections to specific ports, block traffic from specified IP addresses, or deny specific incoming connections.

To manage firewall rules, ispmanager uses the following utilities:

• iptables and ip6tables
• nftables

The choice of rule management mechanism depends on the operating system configuration and the traffic filtering tools available on the server. In some cases, ispmanager uses nftables if iptables and ip6tables are not installed on the server, but nftables is available. If no utilities are available on the server, iptables and ip6tables will be used.

Operation principles

The Firewall module in ispmanager controls access to the server through allow and deny rules. To create a rule, set the parameters.

After saving a new rule, ispmanager sequentially checks:

1. Does the specified IP address or address range overlap with an existing rule?

2. Are the protocols compatible?

   Compatible protocols 

   Existing rule	New rule	Compatibility
   All protocols	All protocols	✅
   All protocols	TCP	✅
   All protocols	UDP	✅
   TCP	TCP	✅
   UDP	UDP	✅
   TCP	UDP	❌
   UDP	TCP	❌

3. Do the rules' protocol and port scopes overlap?
4. Are the rules' actions inversely related?

If the conditions are not met at any stage of the check, ispmanager creates a separate rule.

If the conditions are met at all stages, the new rule becomes an exception to the existing rule:

• Allow changes to Allow with exceptions. Now allow rule contains a dependent deny sub-rule

• Deny changes to Deny with exceptions. Now deny rule contains a dependent allow sub-rule

  Example

  An existing rule allows connections from a specific subnet. An administrator creates a rule that denies connections to a specified port from a single IP address within that subnet.

  As a result, the allow rule is assigned a Allow with exceptions status, and the deny rule appears within it as an exception.

Processing firewall rules

Adding firewall rules

When starting ispmanager for the first time, the following chains will be created for iptables (ip6tables):

• ispmgr_deny_ip — contains denied IP addresses
• ispmgr_allow_ip — contains allowed IP addresses
• ispmgr_allow_sub — contains allowed subnets
• ispmgr_deny_sub — contains denied subnets

Rules for accessing these chains are added to the beginning of the INPUT chain of the filter table in the specified order.

In RHEL-based operating systems, before accessing the ispmanager chains, allow rules required for the panel and some services, including FTP, web services, and mail, are added to the INPUT chain.

Each chain has a range of 10,000 numbers. Therefore, the number of rules in a single chain should not exceed 10,000. Exceeding this limit may result in an error.

When using nftables, ispmanager creates tables and adds chains of similar purpose to them.

Details of chain operation

• Firewall module rules are processed before custom rules that were in the chain before the panel was installed.
• Manually added chain parameters may not be recognized correctly by the panel. Simultaneous firewall configuration via ispmanager, the terminal, configuration files, or other services may result in rule conflicts.

Server availability check

When adding or removing rules, ispmanager checks whether the action will result in access being lost from the IP address from which the administrator is connected to the control panel. The control panel also checks the availability of server IP addresses for local requests.

The control panel does not allow:

• blocking the IP address the connection was made from
• blocking the subnet containing the connecting IP address if there is no separate allow rule
• creating a deny rule for a port and any of the server IP addresses if there is no allow rule for that address

Rules related to subnets or specific IP addresses of another rule's network are logically grouped by the control panel and displayed as nested rules.

Blocking by country

In ispmanager, the Firewall module can block access for users from selected countries. The user's country is determined from one of the following databases:

• IP2Location LITE. Server protection in ispmanager is configured via IP2Location
• GeoIP. Server protection in ispmanager is configured via MaxMind

The module recognizes networks in the desired country from the database and blocks them. When maximum protection is enabled, all networks from all countries are blocked.

For both GeoIP and IP2Location LITE, all blocked IP addresses are added to the rules:

• ispmgr_geoip_deny — for nftables and iptables
• ispmgr_geoip_deny_v6 — for ip6tables

To view the list of blocked networks:

1. Connect to the server running the ispmanager panel via SSH.

2. Run the following command in the terminal:

   ipset list

Technical details

Firewall configuration files: