1

I'm trying to use iptables on my newly purchased openvz container. Everything was going well until I noticed that apt-get wasn't working, looking round I discovered some tutorials which said that established connections were required using the below command:

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

When I run this though I get the error:

iptables: No chain/target/match by that name.

Looking online I see that it may need to be modprobe loaded provided the module is compiled in the kernel, so I tried the following with the below result:

root:~# modprobe nf_conntrack

modprobe: ERROR: ../libkmod/libkmod.c:508 kmod_lookup_alias_from_builtin_file() could not open builtin file '/lib/modules/2.6.32-042stab105.14/modules.builtin.bin'
modprobe: FATAL: Module nf_conntrack not found.

root:~# modprobe *conntrack*

modprobe: ERROR: ../libkmod/libkmod.c:508 kmod_lookup_alias_from_builtin_file() could not open builtin file '/lib/modules/2.6.32-042stab105.14/modules.builtin.bin'
modprobe: FATAL: Module *conntrack* not found.

This implied to me that Conntrack wasn't compiled in the kernel but on contacting the hosts support team they've assured me that it is enabled in the hosted node. On contacting them again they said to install the Conntrack package.

Could someone tell me how as the only package I found from apt was Conntrack-tools which doesn't look like it would have helped (and certainly made no difference on install/restart).

Finally after asking if they could give more assistance they pointed out that since I'm on an unmanaged service they could provide no more help and I would have to fix it at my end.

I've even tried reinstalling the OS and changing it from 14.04 to 15.x in case I got a newer kernel version from it (though I thought this unlikely).

Since I'm now completely lost as to why this isn't working I'm hoping someone on here can help either by saying try this/that, telling me I'm not wrong that it isn't in the kernel or perhaps telling me a workaround for acknowledging packets so I can just not use Conntrack.

Thanks for any help/advice you can give.

1 Answer 1

0

I think the root issue is with openz. Here is quote from here

OpenVZ servers share a kernel with the host, and as a result, you cannot load any kernel modules, and do some other tasks.

2
  • I expected it to be something like that, Further investigation shows that I can use the following iptables commands to get round the lack of Conntrack however I'm unsure what security implications there'd be from them. If they were risky then I'd only enable them as required for apt-get > iptables -A INPUT -p udp --sport 53 --dport 32786:61000 -j ACCEPT > iptables -A INPUT -p tcp --dport 80 --sport 32786:61000 -j ACCEPT > iptables -A INPUT -p tcp --dport 32786:61000 --sport 80 -j ACCEPT - Also thanks to Neil for the code tags, I'm not having much luck adding them to my own posts :( Oct 26, 2015 at 15:14
  • Your dport and sport ranges make no sense to me, as both higher and lower numbered ports would normally be used. Myself, I wouldn't bother. Oct 31, 2015 at 2:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .