OpenVZ Forum


Home » General » Support » ipt_state missing in 2.6.16?
ipt_state missing in 2.6.16? [message #2202] Fri, 24 March 2006 19:06 Go to next message
jdonalds is currently offline  jdonalds
Messages: 9
Registered: March 2006
Location: Michigan, US
Junior Member
Tried to compile from src with the patch (as I have to compile zaptel drivers for asterisk) and I can not get ipt_state to compile as a module, even though it shows as =m in the .config file... any ideas?

-UPDATE-
Hmm...looking through the source looks like ipt_state is depreciated and xt_state under linux-2.6.16/net/netfilter/xt_state.c takes it's place....

[Updated on: Fri, 24 March 2006 20:56]

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2214 is a reply to message #2202] Fri, 24 March 2006 21:49 Go to previous messageGo to next message
jdonalds is currently offline  jdonalds
Messages: 9
Registered: March 2006
Location: Michigan, US
Junior Member
Ok. take 2: xt_state will not load since it requires ip_conntrack and ip_conntrack dies with:

ip_conntrack: Unknown parameter `ip_conntrack_enable_ve0'

any ideas?

has anyone gotten iptables stste to work with the new dev kernel?

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2215 is a reply to message #2214] Fri, 24 March 2006 22:14 Go to previous messageGo to next message
jdonalds is currently offline  jdonalds
Messages: 9
Registered: March 2006
Location: Michigan, US
Junior Member
Duh...

Figured it out, still had legacy ip_conntrack_enable_ve0 set in the modprobe.conf file...

At least it loads for the host system now...need to check the VPS..

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2225 is a reply to message #2215] Sun, 26 March 2006 01:58 Go to previous messageGo to next message
jdonalds is currently offline  jdonalds
Messages: 9
Registered: March 2006
Location: Michigan, US
Junior Member
Hmmm..VPS will not work with xt_state...

so no stateful FW in VPS in 2.6.16....so far...

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2241 is a reply to message #2225] Mon, 27 March 2006 08:48 Go to previous messageGo to next message
dev is currently offline  dev
Messages: 1693
Registered: September 2005
Location: Moscow
Senior Member
Can you please describe preciesly what you do and what is not working? I will ask someone to check then.

http://static.openvz.org/userbars/openvz-developer.png

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2248 is a reply to message #2241] Mon, 27 March 2006 14:00 Go to previous messageGo to next message
jdonalds is currently offline  jdonalds
Messages: 9
Registered: March 2006
Location: Michigan, US
Junior Member
ipt_state is missing in 2.6.16, but if you look through the code for xt_state it appears to be a replacement for ipt_state. However it does not look like xt_state works inside a VPS, as all rules with a -m state fail...

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2282 is a reply to message #2248] Tue, 28 March 2006 08:51 Go to previous messageGo to next message
dim is currently offline  dim
Messages: 344
Registered: August 2005
Senior Member
xt_state is renamed ipt_state, and I can assign any -m state rule in my VPSs. Could you post more details:
1) kernel version (config if custom kernel)
2) cat /etc/sysconfig/vz
3) cat /etc/sysconfig/vz-scripts/<VPSID>.conf
4) lsmod output before VPS start
5) iptables command which fails and it's error output

http://static.openvz.org/openvz_userbar_en.gif

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2289 is a reply to message #2282] Tue, 28 March 2006 13:40 Go to previous messageGo to next message
jdonalds is currently offline  jdonalds
Messages: 9
Registered: March 2006
Location: Michigan, US
Junior Member
Sure, using a self compiled 2.6.16 kernel using patches and the smp kernel config(since I needed to compile zaptel drivers).

What do you mean xt_state is renamed ipt_state? Where. Did you rename it or link to it?

tried to pass xt_state through to VPS by adding it to the line in vz conf...I am not where I can get the config files right now...is their a simple fix?

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2291 is a reply to message #2289] Tue, 28 March 2006 14:40 Go to previous messageGo to next message
dim is currently offline  dim
Messages: 344
Registered: August 2005
Senior Member
You don't need rename it in VPS config or in /etc/sysconfig/vz - OpenVZ still uses old naming for compatibility. New name is due to {ip,ip6,arp}_unification, which is going on in mainstream kernel.
So, you need to have - loaded xt_state module (it is new kernel option - CONFIG_NETFILTER_XT_MATCH_STATE) before VPS start, "ipt_state" word in IPTABLES definition in global or VPS config file.

http://static.openvz.org/openvz_userbar_en.gif

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2292 is a reply to message #2289] Tue, 28 March 2006 14:45 Go to previous messageGo to next message
dev is currently offline  dev
Messages: 1693
Registered: September 2005
Location: Moscow
Senior Member
jdonalds, I suppose dim meant that vzctl still uses name ipt_state for this module, when setting iptables for VPS.
But the kernel module itself was renamed to xt_state.
Thats why he asked you about lsmod output and other config files. You simply have something misconfigured in your system I think.

http://static.openvz.org/userbars/openvz-developer.png

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2892 is a reply to message #2202] Tue, 25 April 2006 15:40 Go to previous messageGo to next message
ronaldsh is currently offline  ronaldsh
Messages: 5
Registered: April 2006
Junior Member
I have the similar problem , here is my answer (in RED)

1) kernel version (config if custom kernel)
2.6.8-022stab076.1

2) cat /etc/sysconfig/vz
## Global parameters
VIRTUOZZO=yes
LOCKDIR=/vz/lock
VE0CPUUNITS=1000

## Logging parameters
LOGGING=yes
LOGFILE=/var/log/vzctl.log
LOG_LEVEL=0

## Disk quota parameters
DISK_QUOTA=yes
VZFASTBOOT=no

# The name of the device whose ip address will be used as source ip for VE.
# By default automatically assigned.
#VE_ROUTE_SRC_DEV="eth0"

## Template parameters
TEMPLATE=/vz/template

## Defaults for VEs
VE_ROOT=/vz/root/$VEID
VE_PRIVATE=/vz/private/$VEID
CONFIGFILE="vps.basic"
DEF_OSTEMPLATE="fedora-core-4"

## Load vzwdog module
VZWDOG="no"

IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length"

3) cat /etc/sysconfig/vz-scripts/<VPSID>.conf

ONBOOT="yes"

# UBC parameters (in form of barrier:limit)
# Primary parameters
AVNUMPROC="40:40"
NUMPROC="65:65"
NUMTCPSOCK="80:80"
NUMOTHERSOCK="80:80"
VMGUARPAGES="6144:2147483647"
# Secondary parameters
KMEMSIZE="2752512:2936012"
TCPSNDBUF="319488:524288"
TCPRCVBUF="319488:524288"
OTHERSOCKBUF="132096:336896"
DGRAMRCVBUF="132096:132096"
OOMGUARPAGES="6144:2147483647"
# Auxiliary parameters
LOCKEDPAGES="32:32"
SHMPAGES="8192:8192"
PRIVVMPAGES="49152:53575"
NUMFILE="2048:2048"
NUMFLOCK="100:110"
NUMPTY="16:16"
NUMSIGINFO="256:256"
DCACHESIZE="1048576:1097728"

PHYSPAGES="0:2147483647"
NUMIPTENT="128:128"

# Disk quota parameters (in form of softlimit:hardlimit)
DISKSPACE="1048576:1153434"
DISKINODES="200000:220000"
QUOTATIME="0"

# CPU fair sheduler parameter
CPUUNITS="1000"
VE_ROOT="/vz/root/$VEID"
VE_PRIVATE="/vz/private/$VEID"
OSTEMPLATE="centos-4-i386-default"
ORIGIN_SAMPLE="vps.basic"
HOSTNAME="x.x.com"
IP_ADDRESS="x.x.x.x"
NAMESERVER="x.x.x.x"

4) lsmod output before VPS start

Module Size Used by
ipt_LOG 6176 1
ipt_state 1632 1
ip_conntrack 35752 1 ipt_state
simfs 3612 1
vzdquota 38736 1 [permanent]
af_packet 16360 0
ipt_length 1504 1
ipt_ttl 1632 1
ipt_tcpmss 1920 1
ipt_TCPMSS 3648 1
iptable_mangle 4256 1
ipt_multiport 1760 1
ipt_limit 1952 1
ipt_tos 1408 1
ipt_REJECT 5568 2
parport_pc 23104 0
lp 7976 0
parport 20544 2 parport_pc,lp
sunrpc 129028 1
vznetdev 12480 3
vzmon 41664 2 vznetdev
vzdev 1792 3 vzdquota,vznetdev,vzmon
iptable_filter 4096 2
ip_tables 20880 12 ipt_LOG,ipt_state,ipt_length,ipt_ttl,ipt_tcpmss,ipt_TCPMSS,i ptable_mangle,ipt_multiport,ipt_limit,ipt_tos,ipt_REJECT,ipt able_filter
thermal 10096 0
processor 10244 1 thermal
fan 2668 0
button 4408 0
battery 7052 0
asus_acpi 8920 0
ac 3084 0
ohci_hcd 17988 0
usbcore 100356 3 ohci_hcd
tg3 100036 0
floppy 54192 0
ide_cd 36800 0
cdrom 37212 1 ide_cd

5) iptables command which fails ( this step is done in VPS )

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

5) it's error output ( this step is done in VPS )

iptables: No chain/target/match by that name

Report message to a moderator

Re: ipt_state missing in 2.6.16? [message #2893 is a reply to message #2892] Tue, 25 April 2006 15:56 Go to previous messageGo to next message
dev is currently offline  dev
Messages: 1693
Registered: September 2005
Location: Moscow
Senior Member
Add "ipt_state ip_conntrack"
to variable
IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length"

in /etc/sysconfig/vz.

http://static.openvz.org/userbars/openvz-developer.png

Report message to a moderator

icon7.gif  Re: ipt_state missing in 2.6.16? [message #2902 is a reply to message #2893] Wed, 26 April 2006 02:01 Go to previous message
ronaldsh is currently offline  ronaldsh
Messages: 5
Registered: April 2006
Junior Member
DONE ! Very Happy

Thanks

Report message to a moderator

Previous Topic: linux 2.6.8 compile error arch/i386/kernel/process.c
Next Topic: server crash
Goto Forum:
  

[ Syndicate this forum (XML) ] [ RSS ] [ PDF ]

Current Time: Fri Apr 19 02:01:58 GMT 2024

Total time taken to generate the page: 0.01790 seconds
Powered by FUDforum Powered by Virtuozzo Containers