OpenVZ Forum - RDF feed
type: channel
items: *SOLVED* Firewall tutorial
items: Re: Firewall tutorial

*SOLVED* Firewall tutorial
type: item
description: Hi, Is there some doc about setting up a basic iptables firewall inside a VE? I can't find one... Regards, Ugo
creator: ugob
date: 2007-04-12T04:07:07-00:00

Re: Firewall tutorial
type: item
description: More precisely, I get this error: iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. 2.6.9-023stab040.1 In vz.conf: IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length" in the VEID.conf file: IPTABLES="iptable_nat" (I also tried with nothing). No iptables rules active on VE0 (host). Thanks,
creator: ugob
date: 2007-04-12T04:16:55-00:00

Re: Firewall tutorial
type: item
description: Helly, Very probably required iptables kernel modules are not loaded: you should load these modules in VE0 before starting the VE in question. HTH, Vasily.
creator: Vasily Tarasov
date: 2007-04-13T14:23:48-00:00

Re: Firewall tutorial
type: item
description: [root@svr01 ~]# lsmod Module Size Used by simfs 3676 4 vzethdev 7692 0 vzrst 161736 0 iptable_nat 26296 3 vzrst vzcpt 127704 0 ip_conntrack 44852 4 vzrst,iptable_nat,vzcpt vzdquota 53840 4 [permanent] ipt_length 1376 3 ipt_ttl 1536 3 ipt_tcpmss 1920 3 ipt_TCPMSS 3616 3 iptable_mangle 4192 3 iptable_filter 4032 3 ipt_multiport 1728 3 ipt_limit 2528 3 ipt_tos 1312 3 ipt_REJECT 5792 3 ip_tables 22256 11 iptable_nat,ipt_length,ipt_ttl,ipt_tcpmss,ipt_TCPMSS,iptable _mangle,iptable_filter,ipt_multiport,ipt_limit,ipt_tos,ipt_R EJECT vznetdev 13408 9 vzmon 47900 8 vzethdev,vzrst,vzcpt,vznetdev vzdev 3008 4 vzethdev,vzdquota,vznetdev,vzmon af_packet 21928 4 uhci_hcd 33272 0 ehci_hcd 31780 0 via_rhine 23368 0 mii 4544 1 via_rhine floppy 62480 0
creator: ugob
date: 2007-04-13T16:46:57-00:00

Re: Firewall tutorial
type: item
description: http://kb.swsoft.com/article_130_875_en.html That article might help you, I used it to install APF on my VPS's. It is made for Virtuozzo, but it works on OpenVZ.
creator: devonblzx
date: 2007-04-13T17:03:50-00:00

Re: Firewall tutorial
type: item
description: Oh, I've just noticed that your veid.conf file contents only "iptable_nat"! It's not enough for iptables! Note, also, that parameters from vz.conf and veid.conf are note concatinated - they only replace each other. So in your VE only iptable_nat is allowed. I suggest you to add all required modules to veid.conf file. Vasily.
creator: Vasily Tarasov
date: 2007-04-14T14:00:58-00:00