OpenVZ Forum - RDF feed
type: channel
items: [solved] iptables and multiport modul in openvz
items: Re: iptables and multiport modul in openvz

[solved] iptables and multiport modul in openvz
type: item
description: Hi Everyone! i have a problem using the multiport module within an openvz container. hope someone can help me out! problem description: when using the multiport module within a openvz container, i get an error. all other options/modules work fine. the command also works fine on the host itself! >iptables -t mangle -A OUTPUT -p tcp -m tcp -m multiport -d 192.168.22.4 --dports 3307,3306 -j Out_RULE_2 returns FATAL: Could not load /lib/modules/2.6.26-2-openvz-amd64/modules.dep: No such file or directory FATAL: Could not load /lib/modules/2.6.26-2-openvz-amd64/modules.dep: No such file or directory >iptables -t mangle -A OUTPUT -p tcp -m tcp -j Out_RULE_2 works out fine ANY IDEAS? container system (Debian) ------------------------- >cat /proc/net/ip_tables_matches udplite udp tcp conntrack conntrack state length ttl tcpmss icmp multiport multiport limit tos tos dscp host sytem (Debian) ------------------- Linux server05 2.6.26-2-openvz-amd64 #1 SMP Wed Aug 19 23:15:49 UTC 2009 x86_64 GNU/Linux /etc/vz/vz.conf ## IPv4 iptables kernel modules IPTABLES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp" >cat /proc/net/ip_tables_matches udplite udp tcp conntrack conntrack state length ttl tcpmss icmp multiport multiport limit tos tos dscp >lsmod lsmod Module Size Used by vzethdev 14720 0 vznetdev 24456 2 simfs 8944 1 vzrst 123048 0 vzcpt 106424 0 tun 15492 2 vzrst,vzcpt vzdquota 42868 1 [permanent] vzmon 31376 5 vzethdev,vznetdev,vzrst,vzcpt vzdev 7568 4 vzethdev,vznetdev,vzdquota,vzmon acpi_cpufreq 11792 7 cpufreq_userspace 8452 0 cpufreq_ondemand 11792 1 cpufreq_conservative 11784 0 cpufreq_powersave 6400 0 cpufreq_stats 9120 0 xt_tcpudp 7680 20 nf_conntrack_ipv6 22632 0 ipv6 296384 52 vzrst,vzcpt,vzmon,nf_conntrack_ipv6 nf_conntrack_proto_dccp 11916 0 nf_conntrack_tftp 9748 0 ts_kmp 6272 5 nf_conntrack_amanda 8832 0 nf_conntrack_netlink 20864 0 nf…
creator: nicolas_79
date: 2009-11-14T19:33:37-00:00

Re: iptables and multiport modul in openvz
type: item
description: ok, i found the solution. depmod -a recreates the required files in the module directory. after that everything worked out fine.
creator: nicolas_79
date: 2009-11-16T15:58:49-00:00

Re: iptables and multiport modul in openvz
type: item
description: Hello, I am having the same problems that you are having but when starting APF firewall. Did you run depmod -a on the host server? I have this on vz.conf: [code]IPTABLES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"[code] My container is also a Debian. The strange thing is that APF works on containers running CentOS.
creator: fernandomm
date: 2009-11-17T23:54:13-00:00

Re: iptables and multiport modul in openvz
type: item
description: Hi fernandomm, fernandomm wrote on Tue, 17 November 2009 18:54 Did you run depmod -a on the host server? You will have to run depmod -a in the container. Probably it will then tell you that the target directory (/lib/modules/2.6.26-2-openvz-amd64/) does not exist. create it as root and then re-run depmod -a. iptables should then work with all loaded modules. fernandomm wrote on Tue, 17 November 2009 18:54 The strange thing is that APF works on containers running CentOS. as far as i can see the problem lies in the fact that the depmod file was not created in the debian template / container. this probably is based on the fact that this module dependency file normally is created when the kernel image is installed. as this is not necessary when using openvz it has to be done manually and is not described in the "debian template creation instructions" found in the wiki. Since it works out for CentOS i could imagine that either the CentOS template contained this informations already (perhaps it was a preconfigured download) or something similar. best regards nicolas
creator: nicolas_79
date: 2009-11-18T08:22:28-00:00

Re: iptables and multiport modul in openvz
type: item
description: Thanks a lot. That did the trick
creator: fernandomm
date: 2009-11-18T11:01:34-00:00