ConfigServer Firewall (AKA csf) is an essential security tool for Linux based server and VPS.<\/p>\n
The installation of CSF is pretty straight forward and is described here: http:\/\/configserver.com\/free\/csf\/install.txt<\/p>\n
However, some of the iptables modules required by the csf might not be present in the server and when the perl test command ( # perl \/usr\/local\/csf\/bin\/csftest.pl<\/em> ) is run in the VPS container while installing csf – the following fatal error may be encountered:<\/p>\n [root@vps-xyz ~]# perl \/etc\/csf\/csftest.pl<\/span> To resolve the issue – You’ll need to have access to your Hardware node (main server – not the VPS container). If you do not have access to the main server you may provide this guide to your VPS provider. Now you need to do the following steps:<\/p>\n 1.<\/strong> First, you need to define required iptables modules are available for VPS. Edit \/etc\/sysconfig\/vz<\/strong> file:<\/p>\n 2.<\/strong> Restart Virtuozzo\/OpenVZ:<\/p>\n 3.<\/strong> execute the command (Assuming your VPS’s CTID is 1001):<\/p>\n 4.<\/strong> Now run the perl test command once again in the VPS container and you should see the result successful:<\/p>\n 5.<\/strong> Finally restart CSF:<\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" ConfigServer Firewall (AKA csf) is an essential security tool for Linux based server and VPS. The installation of CSF is pretty straight forward and is described here: http:\/\/configserver.com\/free\/csf\/install.txt However, some of the iptables modules required by the csf might not be present in the server and when the perl test command ( # perl \/usr\/local\/csf\/bin\/csftest.pl…<\/p>","protected":false},"author":1,"featured_media":327,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,18,6,12,1],"tags":[109,117,116,112,113,95,114,118,115],"how-to":[],"_links":{"self":[{"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/posts\/326"}],"collection":[{"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/comments?post=326"}],"version-history":[{"count":0,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/posts\/326\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/media\/327"}],"wp:attachment":[{"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/media?parent=326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/categories?post=326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/tags?post=326"},{"taxonomy":"how-to","embeddable":true,"href":"https:\/\/hasibul.info\/blog\/wp-json\/wp\/v2\/how-to?post=326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Testing ip_tables\/iptable_filter…OK<\/span>
Testing ipt_LOG…FAILED [ 4294967295] – Required for csf to function<\/span>
Testing ipt_multiport\/xt_multiport…FAILED [FATAL Error: iptables: Unknown error 4294967295] – Required for csf to function<\/span>
Testing ipt_REJECT…OK<\/span>
Testing ipt_state\/xt_state…FAILED [FATAL Error: iptables: Unknown error 4294967295] – Required for csf to function<\/span>
Testing ipt_limit\/xt_limit…FAILED [FATAL Error: iptables: Unknown error 4294967295] – Required for csf to function<\/span>
Testing ipt_recent…FAILED [Error: iptables: Unknown error 4294967295] – Required for PORTFLOOD and PORTKNOCKING features<\/span>
Testing xt_connlimit…FAILED [Error: iptables: Unknown error 4294967295] – Required for CONNLIMIT feature<\/span>
Testing ipt_owner\/xt_owner…FAILED [Error: iptables: Unknown error 4294967295] – Required for SMTP_BLOCK and UID\/GID blocking features<\/span>
Testing iptable_nat\/ipt_REDIRECT…FAILED [Error: iptables v1.3.5: can’t initialize iptables table `nat’: Table does not exist (do you need to insmod?)] – Required for MESSENGER feature<\/span>
Testing iptable_nat\/ipt_DNAT…FAILED [Error: iptables v1.3.5: can’t initialize iptables table `nat’: Table does not exist (do you need to insmod?)] – Required for csf.redirect feature<\/span><\/p><\/blockquote>\n<\/h1>\n
SOLUTION:<\/strong><\/h1>\n
\nEdit \/etc\/sysconfig\/iptables-config<\/strong> file on the Hardware Node (Main server) and make sure you have the following:<\/p>\nIPTABLES_MODULES=\"ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp\"<\/code><\/p><\/blockquote>\n\n
IPTABLES=\"ipt_REJECT
\nipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp\"<\/code><\/div>\n\n
# service vz restart<\/code><\/div>\n<\/blockquote>\n# vzctl set 1001 --netfilter full --save --setmode restart<\/code><\/p><\/blockquote>\nroot@vps-xyz [~]# perl \/usr\/local\/csf\/bin\/csftest.pl
\nTesting ip_tables\/iptable_filter...OK
\nTesting ipt_LOG...OK
\nTesting ipt_multiport\/xt_multiport...OK
\nTesting ipt_REJECT...OK
\nTesting ipt_state\/xt_state...OK
\nTesting ipt_limit\/xt_limit...OK
\nTesting ipt_recent...OK
\nTesting xt_connlimit...OK
\nTesting ipt_owner\/xt_owner...OK
\nTesting iptable_nat\/ipt_REDIRECT...OK
\nTesting iptable_nat\/ipt_DNAT...OK<\/code><\/p>\nRESULT: csf should function on this server<\/code><\/p><\/blockquote>\n# Service csf restart<\/code><\/p><\/blockquote>\n