Dynamic kernel module load

Dynamic kernel module load

[Paul Harlow]

Hi all,

Fedora 5 patched, i386 SMP

I am looking for info on how to dynamically load a particular kernel module when I restart IPTables. I have firewalling rules in place for FTP traffic (both passive and active) however when I restart IPTables I notice that the module ip_conntrack_ftp does not load, I have to load it manually. This presents a problem if someone other than myself has to reload firewall rules on this machine but isn't aware of the FTP rules/needs.

Will adding the line "ip_conntrack_ftp" to the modules.conf file solve this problem and leave the particular module in permanently?

Paul Harlow
System and Network Administrator
SKLD Information Services LLC
9540 E. Jewell Ave. Suite A
Denver, CO   80247
303.695.3861 - desk
303.913.2804 - cell

Re: Dynamic kernel module load

[Jan Engelhardt]

On May 24 2007 10:31, Paul Harlow wrote:
>Hi all,
>
>Fedora 5 patched, i386 SMP
>
>I am looking for info on how to dynamically load a particular kernel
>module when I restart IPTables. I have firewalling rules in place for FTP
>traffic (both passive and active) however when I restart IPTables I
>notice that the module ip_conntrack_ftp does not load, I have to load it
>manually.

That is because your ruleset only depends [as in: symbols] on
iptable_filter, ip_conntrack and such, but not ip_conntrack_ftp.

>This presents a problem if someone other than myself has to
>reload firewall rules on this machine but isn't aware of the FTP
>rules/needs.
>
>Will adding the line "ip_conntrack_ftp" to the modules.conf file solve
>this problem and leave the particular module in permanently?

Adding it to /etc/sysconfig/kernel variable MODULES_LOADED_ON_BOOT
(opensuse; YMMV) will do that, yes. (modprobe.conf? I do not think
that is the right place.) Until someone manually rmmods it (,yes).


	Jan
-- 

Re: Dynamic kernel module load

[Martijn Lievaart]

Paul Harlow wrote:
> Hi all,
>
> Fedora 5 patched, i386 SMP
>
> I am looking for info on how to dynamically load a particular kernel module when I restart IPTables. I have firewalling rules in place for FTP traffic (both passive and active) however when I restart IPTables I notice that the module ip_conntrack_ftp does not load, I have to load it manually. This presents a problem if someone other than myself has to reload firewall rules on this machine but isn't aware of the FTP rules/needs.
>
> Will adding the line "ip_conntrack_ftp" to the modules.conf file solve this problem and leave the particular module in permanently?
>   

Patch /etc/sysconfig/iptables-config, mine looks like:

# Additional iptables modules (nat helper)
# Default: -empty-
IPTABLES_MODULES="ip_conntrack_ftp"

(snip)

HTH,
M4

RE: Dynamic kernel module load

[Paul Blondé]

You will either want to add the loading of ip_conntrack_ftp to /etc/rc.local
(see http://iptablesrocks.org), or insert a line into
/etc/sysconfig/iptables-config (or wherever you keep your iptables
configuration file) like this:

IPTABLES_MODULES="ip_conntrack_ftp"



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Paul Blondé