Skip to contentSkip to conversation

Iptables without ipt_state using xt_state

DISCUSSION FiloSottile 5 participants 6 messages Jan 12, 2010 – Jan 13, 2010

lore
Share & tools
lore

FiloSottile

author
#0 lore raw

I am running on a OpenVZ box with static unmodifiable kernel. I have no ipt_state and ipt_connmark but i have xt_state and xt_connmark. I want to build a simple firewall, but when i run that:

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name

How to use xt_state instead ipt_state? Or there is an alternative way to build firewall?
Thank you

Signature · 4 lines
Filippo Valsorda                             FiloSottile@WikiMedia
PADI Rescue Diver #0907EL9205    DAN ADV O2 Provider + BLS #281664
www.filosottile.info                      GPG [email protected]
Key fingerprint 94B6 85B2 AE48 1C47 BD4D  DC5B 16F3 ADA6 01A8 2A13
#1 lore raw
Quoted 11 lines · FiloSottile

I am running on a OpenVZ box with static unmodifiable kernel. I have no ipt_state and ipt_connmark but i have xt_state and xt_connmark. I want to build a simple firewall, but when i run that:

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name

How to use xt_state instead ipt_state? Or there is an alternative way to build firewall?
Thank you

eris:~# modinfo xt_state
filename:
/lib/modules/2.6.24-etchnhalf.1-686/kernel/net/netfilter/xt_state.ko
license:        GPL
author:         Rusty Russell <[email protected]>
description:    ip[6]_tables connection tracking state match module
alias:          ipt_state
alias:          ip6t_state
vermagic:       2.6.24-etchnhalf.1-686 SMP mod_unload 686
depends:        x_tables,nf_conntrack
eris:~# grep -w xt_state /lib/modules/$(uname -r)/modules.alias
alias ipt_state xt_state
alias ip6t_state xt_state

xt_state is the successor of ipt_state.

what does modprobe -v xt_state say?
uname -a?

regards

Mart

author
#2 lore raw

Mart Frauenlob ha scritto:

Quoted 13 lines · FiloSottile
Quoted 5 lines

I am running on a OpenVZ box with static unmodifiable kernel. I have no ipt_state and ipt_connmark but i have xt_state and xt_connmark. I want to build a simple firewall, but when i run that:

Quoted 7 lines
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name

How to use xt_state instead ipt_state? Or there is an alternative way to build firewall?
Thank you

Quoted 11 lines
eris:~# modinfo xt_state
filename:
/lib/modules/2.6.24-etchnhalf.1-686/kernel/net/netfilter/xt_state.ko
license:        GPL
author:         Rusty Russell <[email protected]>
description:    ip[6]_tables connection tracking state match module
alias:          ipt_state
alias:          ip6t_state
vermagic:       2.6.24-etchnhalf.1-686 SMP mod_unload 686
depends:        x_tables,nf_conntrack

modinfo: could not open /lib/modules/2.6.18-128.1.1.el5.028stab062.3PAE/modules.dep

Quoted 4 lines
eris:~# grep -w xt_state /lib/modules/$(uname -r)/modules.alias
alias ipt_state xt_state
alias ip6t_state xt_state
root@vps:~# ls /lib/modules/*
root@vps:~#
Quoted 4 lines

xt_state is the successor of ipt_state.

what does modprobe -v xt_state say?

WARNING: Deprecated config file /etc/modprobe.conf, all config files belong into /etc/modprobe.d/.
FATAL: Could not load /lib/modules/2.6.18-128.1.1.el5.028stab062.3PAE/modules.dep: No such file or directory

Quoted 2 lines

uname -a?

Linux vps.fvnetwork.it 2.6.18-128.1.1.el5.028stab062.3PAE #1 SMP Tue May 5 17:50:37 MSD 2009 i686 GNU/Linux

Quoted 5 lines

regards

Mart

As i said, i am on a OpenVZ VPS, and i cannot modify kernel and modules. The only info that i have is that:

root@vps:~# ls /lib/xtables/ | grep state
libxt_state.so

Does it assure that i have the xt_state module loaded? In case how can i verify if it works?
And in case it doesn't work, how can i get a simple one-host firewall?

Thank you

Signature · 5 lines
Filippo Valsorda                             FiloSottile@WikiMedia
Linux registered user #492189        Ubuntu registered user #27865
PADI Rescue Diver #0907EL9205    DAN ADV O2 Provider + BLS #281664
www.filosottile.info                      GPG [email protected]
Key fingerprint 94B6 85B2 AE48 1C47 BD4D  DC5B 16F3 ADA6 01A8 2A13
#3 lore raw

Hello,

Quoted 5 lines · FiloSottile
root@vps:~# ls /lib/xtables/ | grep state
libxt_state.so

Does it assure that i have the xt_state module loaded?

No. This is a shared library, just a piece of the userland iptables. If you have access, you can check the kernel config file in /boot or in /proc/config.gz.

#4 lore raw
In reply to FiloSottile
Quoted 10 lines · FiloSottile

Mart Frauenlob ha scritto:

Quoted 2 lines

what does modprobe -v xt_state say?

WARNING: Deprecated config file /etc/modprobe.conf, all config files belong into /etc/modprobe.d/.
FATAL: Could not load /lib/modules/2.6.18-128.1.1.el5.028stab062.3PAE/modules.dep: No such file or directory

As i said, i am on a OpenVZ VPS, and i cannot modify kernel and modules.

The module needs to be loaded in the initial namespace to be available in the VPS.

#5 lore raw
In reply to FiloSottile
Quoted 1 line · FiloSottile

I am running on a OpenVZ box with static unmodifiable kernel.

I suspect that this comes down to being a support issue with your service provider. Did you ask them?

Signature · 2 lines
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header