OpenVZ Forum - RDF feed
type: channel
items: *RESOLVED* APF firewall problem!
items: Re: APF firewall problem!
items: Re: *RESOLVED* APF firewall problem!

*RESOLVED* APF firewall problem!
type: item
description: Hello. I am running two VPS's. They are both from the same VPS provider. They are both the same OS with the same kernel. I have rebuilt both from scratch and then run yum update on both. I installed apf firewall on VPS A and VPS B after modifying conf.apf with the following changes on both VPS's: changed interfaces to 'venet0', opened necessary ingress ports (outgoing filtering is set to 0), and then set monokern to 1 When I run apf on VPS A, it starts fine with no errors, when I run the same on VPS B, it starts, but I get a bunch of errors. Here is the total output of the startup sequence on the VPS with errors: [root@vpsB ~]# apf -s apf(29931): {glob} activating firewall apf(29988): {glob} determined (IFACE_IN) venet0 has address 127.0.0.1 apf(29988): {glob} determined (IFACE_OUT) venet0 has address 127.0.0.1 apf(29988): {glob} loading preroute.rules iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name apf(29988): {resnet} downloading http://r-fx.ca/downloads/reserved.networks apf(29988): {resnet} parsing reserved.networks into /etc/apf/internals/reserved.networks apf(29988): {glob} loading reserved.networks apf(29988): {glob} loading bt.rules apf(29988): {dshield} downloading http://feeds.dshield.org/top10-2.txt apf(29988): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules apf(29988): {dshield} loading ds_hosts.rules apf(29988): {sdrop} downloading http://www.spamhaus.org/drop/drop.lasso apf(29988): {sdrop} parsing drop.lasso into /etc/apf/sdrop_hosts.rules apf(29988): {sdrop} loading sdrop_hosts.rules apf(29988): {glob} loading common drop ports apf(29988): {blk_ports} deny all to/from tcp port 135:139 apf(2…
creator: omega36
date: 2007-06-06T15:12:43-00:00

Re: APF firewall problem!
type: item
description: I had similar problem. You must configure iptables modules in several place. Search this forum for apf and you should find...
creator: ugob
date: 2007-06-06T15:15:12-00:00

Re: APF firewall problem!
type: item
description: I have searched and I can't find anything, is there something more specific I should be looking for
creator: omega36
date: 2007-06-06T15:33:53-00:00

Re: APF firewall problem!
type: item
description: http://kb.swsoft.com/article_130_875_en.html
creator: ugob
date: 2007-06-06T15:38:20-00:00

Re: APF firewall problem!
type: item
description: I have done everything that I can in OpenVZ as a end-user of a VPS supplier with that guide, but that hasn't helped me either... any other ideas?
creator: omega36
date: 2007-06-06T15:45:21-00:00

Re: APF firewall problem!
type: item
description: Ask your supplier if you can use iptables rules in your VE,
creator: ugob
date: 2007-06-06T15:51:46-00:00

Re: APF firewall problem!
type: item
description: That's my problem. The VPS's are on the same main server from the same provider, using the same OS with identical kernels, so surely iptables is supported? This is really confusing me because I cant for the likes of me see why two basically identical setups wouldn't run apf the same!!
creator: omega36
date: 2007-06-06T15:55:16-00:00

Re: APF firewall problem!
type: item
description: Hello, Even in your situation, when "VPS's are on the same main server from the same provider, using the same OS with identical kernels", it can happen, that one VPS is able to apply iptbables rules and the other one is not able to do it. The following two reasons I see: 1. One of VPSs (the one, that can't work with iptables) was started later then iptables kernel modules were loaded by provider on HN. To check it - reboot your VE. If after reboot iptables still doesn't work - see 2nd reason. 2. Your provider have different configuration files for the VPSs in question. In VPS config file provider indicates, which iptables modules are available in this VPS. So, probably the line with iptables is just missed in "not working" VPS config file. In this situation you should contact your provider and ask him to check configuration. HTH, Vasily.
creator: Vasily Tarasov
date: 2007-06-07T06:46:18-00:00

Re: APF firewall problem!
type: item
description: Thank you Vasily, A reboot did not help, so I will contact the VPS provider and ask him to check iptables part of the config of the VPS in question. Regards, Curtis.
creator: omega36
date: 2007-06-07T07:00:27-00:00

Re: APF firewall problem!
type: item
description: #cat /proc/net/ip_tables_targets #cat /proc/net/ip_tables_names what do they say?
creator: rickb
date: 2007-06-07T07:24:02-00:00

Re: APF firewall problem!
type: item
description: [root@x ~]# cat /proc/net/ip_tables_names mangle filter nat [root@x ~]# cat /proc/net/ip_tables_targets REDIRECT LOG TCPMSS REJECT TOS DNAT SNAT
creator: omega36
date: 2007-06-07T07:32:17-00:00

Re: APF firewall problem!
type: item
description: looks ok. I ran into this problem a few times. what I did to solve it in a few minutes was edit the apf script, and have it echo out the iptables commands as it runs them,. that way, you can see what the command is that is causing the errors: iptables: No chain/target/match by that name apf isn't a firewall, but an iptables wrapper script. to know whats going on, you need to edit the apf script to print what its doing. once you have the specific iptables rule which is failing, the problem should be obvious.
creator: rickb
date: 2007-06-07T07:35:37-00:00

Re: APF firewall problem!
type: item
description: How do I go about doing that?
creator: omega36
date: 2007-06-07T07:38:41-00:00

Re: APF firewall problem!
type: item
description: Nevermind... it has started working with no errors now. Strange, I have not changed anything since it last didn't work
creator: omega36
date: 2007-06-07T08:03:38-00:00

Re: APF firewall problem!
type: item
description: Apparently, my mere presence was sufficient to solve the problem.
creator: rickb
date: 2007-06-07T08:04:54-00:00

Re: *RESOLVED* APF firewall problem!
type: item
description: Haha, indeed it was
creator: omega36
date: 2007-06-07T08:13:05-00:00