SOLVED Host Access Control not working

[tom9909]

Hi everyone,

We have a new cPanel DNSOnly installation (AlmaLinux v8.7) and have configured host access control to only accept traffic on specific ports, however the rules aren't applying and the server is accessible outside of the IP exclusions configured.

The configuration is:

2	22	IP address redacted	tcp	ACCEPT
3	22	IP address redacted	tcp	ACCEPT
4	22	IP address redacted	tcp	ACCEPT
6	22	IP address redacted	tcp	ACCEPT
7	22	ALL	tcp	REJECT
9	2087	IP address redacted	tcp	ACCEPT
10	2087	IP address redacted	tcp	ACCEPT
11	2087	IP address redacted	tcp	ACCEPT
12	2087	IP address redacted	tcp	ACCEPT
13	2087	ALL	tcp	REJECT

When I check /etc/sysconfig/nftables.conf the rules are listed in the 'table inet filter' section.

Have I misunderstood something with regards to AlmaLinux and Host Access Control?

Thanks

 

[cPRex]

Hey there! That certainly looks right, and follows the details outlined at Host Access Control | cPanel & WHM Documentation

If you run this command on the system, does it properly return your rules?

nft -a list chain inet filter cPanel-HostAccessControl

 

[tom9909]

Hey there! That certainly looks right, and follows the details outlined at Host Access Control | cPanel & WHM Documentation

If you run this command on the system, does it properly return your rules?

nft -a list chain inet filter cPanel-HostAccessControl

Yes the rules exist. I can however SSH and access the web GUI from IPs that aren't approved.

 

[cPRex]

Thanks for the additional details. This is one of those things that should "just work" so could you open a ticket with our team so we can take a look at this directly on the machine?

 

[tom9909]

Thanks for the additional details. This is one of those things that should "just work" so could you open a ticket with our team so we can take a look at this directly on the machine?

Thank you for confirming I wasn't doing something incorrectly I've raised a support case #94520897 for further investigation. Cheers

 

[cPRex]

Thanks for that - it looks like we were able to reset the Host Access Control tools by running "/usr/local/cpanel/scripts/configure_firewall_for_cpanel" - after doing that, we tested things as working properly in the ticket.

 

[tom9909]

Thank you, I can confirm its now working

 

[cPRex]

I'm glad to hear it!