OpenVZ Forum


Home » General » Support » need help using xt_tcpudp and xt_state modules within a VE
need help using xt_tcpudp and xt_state modules within a VE [message #38724] Wed, 20 January 2010 22:17 Go to next message
Jimbo is currently offline  Jimbo
Messages: 9
Registered: November 2008
Junior Member
Hi, I'm running kernel 2.6.18-164.2.1.el5.028stab066.10 x86_64 and vzctl version 3.0.23 on RHEL 5.4. I would like to use iptables commands such as these within a VE:
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT

However, I receive this error when running any one of them:
iptables: Unknown error 18446744073709551615

I am not using any "vzctl --iptables" style restrictions on individual VEs. My /etc/vz/vz.conf has this line in it:
IPTABLES="ipt_REJECT ipt_REDIRECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_nat iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length"

I've tried changing it to:
IPTABLES="ipt_REJECT ipt_REDIRECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_nat iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length xt_tcpudp xt_state"

After a reboot the modules are correctly loaded into the kernel by openvz. However, when entering the VE, I get the following errors:
Warning: Unknown iptable module: xt_tcpudp, skipped
Warning: Unknown iptable module: xt_state, skipped

and get the same "Unknown error 18446744073709551615" when running the iptables commands.

How do I configure openvz to allow me to use the xt_tcpudp and xt_state modules within a VE?
Re: need help using xt_tcpudp and xt_state modules within a VE [message #38733 is a reply to message #38724] Fri, 22 January 2010 14:43 Go to previous messageGo to next message
maratrus is currently offline  maratrus
Messages: 1495
Registered: August 2007
Location: Moscow
Senior Member
Hello,

most probably you need to stop a VE that you are playing with. Then probe xt_state module on the HN, i.e. run
# modprobe xt_state

After that start the VE and everything should work.
The point is that a desired iptable module has to be loaded before VE is started.
Re: need help using xt_tcpudp and xt_state modules within a VE [message #38771 is a reply to message #38733] Mon, 25 January 2010 19:03 Go to previous message
Jimbo is currently offline  Jimbo
Messages: 9
Registered: November 2008
Junior Member
Turns out my problem was that I had my "NUMIPTENT" set too low for this VE. After increasing the value with this command, the problem went away:
vzctl set 2094 --numiptent 64 --save
Previous Topic: oprofile:vmlinuz to vmlinux conversion
Next Topic: HN beancounters and system memory.
Goto Forum:
  


Current Time: Wed Nov 06 02:45:21 GMT 2024

Total time taken to generate the page: 0.03485 seconds