Hi I have recently configured my nodes IPTables but its now throwing out the following error when i try to start a ve's firewall: iptables: Unknown error 4294967295 I have followed the instructions here http://kb.swsoft.com/article_130_875_en.html Node software: CentOS and HyperVM/OpenVZ How do I solve this Regards,
type these in the main node command line and tell me what would happen or how did it go cat /etc/sysconfig/iptables-config cat /etc/sysconfig/vz
Hi! I noticed the same error with an OpenVZ-host today: [root@vserver104 ~]# /sbin/iptables -I INPUT -p tcp --dport 80 iptables: Unknown error 4294967295 The requested information in the post before is: [root@bob jm]# cat /etc/sysconfig/iptables-config # Load additional iptables modules (nat helpers) # Default: -none- # Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which # are loaded after the firewall rules are applied. Options for the helpers are # stored in /etc/modprobe.conf. IPTABLES_MODULES="" # Unload modules on restart and stop # Value: yes|no, default: yes # This option has to be 'yes' to get to a sane state for a firewall # restart or stop. Only set to 'no' if there are problems unloading netfilter # modules. IPTABLES_MODULES_UNLOAD="yes" # Save current firewall rules on stop. # Value: yes|no, default: no # Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped # (e.g. on system shutdown). IPTABLES_SAVE_ON_STOP="no" # Save current firewall rules on restart. # Value: yes|no, default: no # Saves all firewall rules to /etc/sysconfig/iptables if firewall gets # restarted. IPTABLES_SAVE_ON_RESTART="no" # Save (and restore) rule and chain counter. # Value: yes|no, default: no # Save counters for rules and chains to /etc/sysconfig/iptables if # 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or # SAVE_ON_RESTART is enabled. IPTABLES_SAVE_COUNTER="no" # Numeric status output # Value: yes|no, default: yes # Print IP addresses and port numbers in numeric format in the status output. IPTABLES_STATUS_NUMERIC="yes" [root@bob jm]# cat /etc/sysconfig/vz ## Global parameters VIRTUOZZO=yes LOCKDIR=/vz/lock DUMPDIR=/vz/dump VE0CPUUNITS=1000 ## Logging parameters LOGGING=yes LOGFILE=/var/log/vzctl.log LOG_LEVEL=0 ## Disk quota parameters DISK_QUOTA=yes VZFASTBOOT=no # The name of the device whose ip address will be used as source ip for VE. # By default automatically assigned. #VE_ROUTE_SRC_DEV="eth0" ## Template parameters TEMPLATE=/vz/template ## Defaults for VEs VE_ROOT=/vz/root/$VEID VE_PRIVATE=/vz/private/$VEID CONFIGFILE="vps.basic" DEF_OSTEMPLATE="fedora-core-4" ## Load vzwdog module VZWDOG="no" IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length" Any help/hints/further debugging-tipps would be greatly appreciated... Kind regards! Jens
Follow the guide at SWSoft then the thing I didnt do was restart OpenVZ So to fix: 1. Follow SWSoft Guide 2. Issue the command: service hypervm restart 3. Issue the command: service openvz restart Then reboot the node and problems solved. I forgot to restart openvz
Hi! Thank you for your help. I followed the instructions now in detail (added IPTABLES="..." to both files). I restarted the ve and the hardware-node after that - without success. (You can see "the rest" of my config-files in my last post - only IPTABES was adapted.) "iptables" was started on the hardware-node - but without any chain. Is an actual kernel necessary to solve this problem? Actually "2.6.16-026test018.1-smp" is used on hardware-node. Kind regards, Jens
Im not sure, I just followed what my DC told me to do. This was for an openvz/hypervm setup
Hi! We are not using HyperVM but I would suggest that the problem is independent from this component?! I followed the iptables-instructions in detail. Perhaps it depends on the older kernel? Kind regards, Jens
Im no tech expert so I really cant offer much help Sorry
jmeyerdo wrote on Sun, 14 October 2007 02:10 Hi! I noticed the same error with an OpenVZ-host today: [root@vserver104 ~]# /sbin/iptables -I INPUT -p tcp --dport 80 iptables: Unknown error 4294967295 4294967295 = 0xffffffff = -1 Are you sure that you haven't any failcounters in /proc/user_beancounters file? Then could you please strace this command and attach the logs? Also it would be usefulto look at lsmod output on your node. thank you, Vasily Averin
Hi! Thank you for your reply. Yes - there are no failcounters in /proc/user_beancounters on the virtual machine. Find attached the strace-debug-output of the "iptables"-command and the lsmod-output from the hardware-node (hopefully done correctly?). Kind regards, Jens
Could you update the kernel on your node? 2.6.16-026test018.1-smp is really too old.