Iptables without ipt_state using xt_state

Iptables without ipt_state using xt_state

[FiloSottile]

I am running on a OpenVZ box with static unmodifiable kernel.
I have no ipt_state and ipt_connmark but i have xt_state and xt_connmark.
I want to build a simple firewall, but when i run that:

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name

How to use xt_state instead ipt_state? Or there is an alternative way to
build firewall?
Thank you

-- 
Filippo Valsorda                             FiloSottile@WikiMedia
PADI Rescue Diver #0907EL9205    DAN ADV O2 Provider + BLS #281664
www.filosottile.info                      GPG 01A82A13@pgp.mit.edu
Key fingerprint 94B6 85B2 AE48 1C47 BD4D  DC5B 16F3 ADA6 01A8 2A13

Re: Iptables without ipt_state using xt_state

[Mart Frauenlob]

On 12.01.2010 18:34, FiloSottile wrote:
> I am running on a OpenVZ box with static unmodifiable kernel.
> I have no ipt_state and ipt_connmark but i have xt_state and xt_connmark.
> I want to build a simple firewall, but when i run that:
> 
> # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables: No chain/target/match by that name
> 
> How to use xt_state instead ipt_state? Or there is an alternative way to
> build firewall?
> Thank you
> 

eris:~# modinfo xt_state
filename:
/lib/modules/2.6.24-etchnhalf.1-686/kernel/net/netfilter/xt_state.ko
license:        GPL
author:         Rusty Russell <rusty@rustcorp.com.au>
description:    ip[6]_tables connection tracking state match module
alias:          ipt_state
alias:          ip6t_state
vermagic:       2.6.24-etchnhalf.1-686 SMP mod_unload 686
depends:        x_tables,nf_conntrack

eris:~# grep -w xt_state /lib/modules/$(uname -r)/modules.alias
alias ipt_state xt_state
alias ip6t_state xt_state


xt_state is the successor of ipt_state.

what does modprobe -v xt_state say?
uname -a?


regards

Mart

Re: Iptables without ipt_state using xt_state

[FiloSottile]

Mart Frauenlob ha scritto:
> On 12.01.2010 18:34, FiloSottile wrote:
>   
>> I am running on a OpenVZ box with static unmodifiable kernel.
>> I have no ipt_state and ipt_connmark but i have xt_state and xt_connmark.
>> I want to build a simple firewall, but when i run that:
>>
>> # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>> iptables: No chain/target/match by that name
>>
>> How to use xt_state instead ipt_state? Or there is an alternative way to
>> build firewall?
>> Thank you
>>     
> eris:~# modinfo xt_state
> filename:
> /lib/modules/2.6.24-etchnhalf.1-686/kernel/net/netfilter/xt_state.ko
> license:        GPL
> author:         Rusty Russell <rusty@rustcorp.com.au>
> description:    ip[6]_tables connection tracking state match module
> alias:          ipt_state
> alias:          ip6t_state
> vermagic:       2.6.24-etchnhalf.1-686 SMP mod_unload 686
> depends:        x_tables,nf_conntrack
>   
modinfo: could not open
/lib/modules/2.6.18-128.1.1.el5.028stab062.3PAE/modules.dep
> eris:~# grep -w xt_state /lib/modules/$(uname -r)/modules.alias
> alias ipt_state xt_state
> alias ip6t_state xt_state
>   
root@vps:~# ls /lib/modules/*
root@vps:~#
> xt_state is the successor of ipt_state.
>
> what does modprobe -v xt_state say?
>   
WARNING: Deprecated config file /etc/modprobe.conf, all config files
belong into /etc/modprobe.d/.
FATAL: Could not load
/lib/modules/2.6.18-128.1.1.el5.028stab062.3PAE/modules.dep: No such
file or directory
> uname -a?
>   
Linux vps.fvnetwork.it 2.6.18-128.1.1.el5.028stab062.3PAE #1 SMP Tue May
5 17:50:37 MSD 2009 i686 GNU/Linux
> regards
>
> Mart
>
>   
As i said, i am on a OpenVZ VPS, and i cannot modify kernel and modules.
The only info that i have is that:

root@vps:~# ls /lib/xtables/ | grep state
libxt_state.so

Does it assure that i have the xt_state module loaded? In case how can i
verify if it works?
And in case it doesn't work, how can i get a simple one-host firewall?

Thank you

-- 
Filippo Valsorda                             FiloSottile@WikiMedia
Linux registered user #492189        Ubuntu registered user #27865
PADI Rescue Diver #0907EL9205    DAN ADV O2 Provider + BLS #281664
www.filosottile.info                      GPG 01A82A13@pgp.mit.edu
Key fingerprint 94B6 85B2 AE48 1C47 BD4D  DC5B 16F3 ADA6 01A8 2A13

Re: Iptables without ipt_state using xt_state

[Pascal Hambourg]

Hello,

FiloSottile a écrit :
> 
> root@vps:~# ls /lib/xtables/ | grep state
> libxt_state.so
> 
> Does it assure that i have the xt_state module loaded?

No. This is a shared library, just a piece of the userland iptables.
If you have access, you can check the kernel config file in /boot or in
/proc/config.gz.

Re: Iptables without ipt_state using xt_state

[/dev/rob0]

On Tue, Jan 12, 2010 at 06:34:21PM +0100, FiloSottile wrote:
> I am running on a OpenVZ box with static unmodifiable kernel.

I suspect that this comes down to being a support issue with your
service provider. Did you ask them?
-- 
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header

Re: Iptables without ipt_state using xt_state

[Patrick McHardy]

FiloSottile wrote:
> Mart Frauenlob ha scritto:
>> what does modprobe -v xt_state say?
>>   
> WARNING: Deprecated config file /etc/modprobe.conf, all config files
> belong into /etc/modprobe.d/.
> FATAL: Could not load
> /lib/modules/2.6.18-128.1.1.el5.028stab062.3PAE/modules.dep: No such
> file or directory

> As i said, i am on a OpenVZ VPS, and i cannot modify kernel and modules.

The module needs to be loaded in the initial namespace to
be available in the VPS.

Re: Iptables without ipt_state using xt_state

[FiloSottile]

I cannot verify if the module is loaded from the config, but if it is
loaded the command

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

should work...
So, if don't have that module loaded, how can i do to get a firewall
configured?

Thank you

-- 
Filippo Valsorda                             FiloSottile@WikiMedia
Linux registered user #492189        Ubuntu registered user #27865
PADI Rescue Diver #0907EL9205    DAN ADV O2 Provider + BLS #281664
www.filosottile.info                      GPG 01A82A13@pgp.mit.edu
Key fingerprint 94B6 85B2 AE48 1C47 BD4D  DC5B 16F3 ADA6 01A8 2A13

Re: Iptables without ipt_state using xt_state

[Mart Frauenlob]

On 13.01.2010 13:50, FiloSottile wrote:
> I cannot verify if the module is loaded from the config, but if it is
> loaded the command
> 
> # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> should work...
> So, if don't have that module loaded, how can i do to get a firewall
> configured?

Patrick McHardy already pointed it out, but this may help to understand:

http://wiki.openvz.org/Setting_up_an_iptables_firewall

chapter:
'Setting up a firewall that allows per-container configuration '


If you can't do it, it comes down to what /dev/rob0 said:

> I suspect that this comes down to being a support issue with your
> service provider. Did you ask them?

regards

Mart