Since we are in the field of VPS hosting technical support we know the importance of firewall in a VPS.So that the blog is intended to provide the steps to enable iptables in a VPS.
Before trying to enable iptable modules on the VPS, make sure that those modules are enabled on the root node server. To check whether the particular iptable modules are enabled or not on the root node, execute the following command.
lsmod
A Sample out put for the lsmod is :
Module Size Used by
xt_helper 35584 0
ip_conntrack_ftp 42320 2
ipt_LOG 39808 0
ipt_owner 34944 0
ipt_REDIRECT 34944 0
ipt_recent 43404 2
xt_state 35200 5
sch_sfq 38912 1
cls_u32 41352 1
sch_cbq 50688 1
ppp_deflate 39168 0
zlib_deflate 52760 1 ppp_deflate
ppp_async 45184 0
ppp_generic 62624 2 ppp_deflate,ppp_async
slhc 39552 1 ppp_generic
crc_ccitt 35200 1 ppp_async
tun 47872 0
vzethdev 47264 0
simfs 38296 36
vzrst 173096 0
vzcpt 148792 0
vzdquota 78832 36 [permanent]
xt_tcpudp 36224 21
xt_length 34944 0
ipt_ttl 34816 0
xt_tcpmss 35328 0
ipt_TCPMSS 37248 0
iptable_mangle 37888 36
xt_multiport 36224 0
xt_limit 36352 4
ipt_tos 34560 0
ipt_REJECT 39556 1
iptable_nat 43532 46
ip_nat 53392 3 ipt_REDIRECT,vzrst,iptable_nat
iptable_filter 37760 42
ip_conntrack 100884 29 xt_helper,ip_conntrack_ftp,xt_state,vzrst,vzcpt,iptable_nat,ip_nat
nfnetlink 40392 2 ip_nat,ip_conntrack
ip_tables 57440 3 iptable_mangle,iptable_nat,iptable_filter
x_tables 52744 17 xt_helper,ipt_LOG,ipt_owner,ipt_REDIRECT,ipt_recent,xt_state,xt_tcpudp,xt_length,ipt_ttl,xt_tcpmss,ipt_TCPMSS,xt_multiport,xt_limit,ipt_tos,ipt_REJECT,iptable_nat,ip_tables
autofs4 57480 2
hidp 83584 2
rfcomm 105000 0
Here we can see most of the modules are already enabled on the node server. If not enabled, execute the following commands one by one to enable those.
modprobe ipt_helper
modprobe ipt_REDIRECT
modprobe ipt_state
modprobe ipt_TCPMSS
modprobe ipt_LOG
modprobe ipt_TOS
modprobe iptable_nat
modprobe ipt_length
modprobe ipt_tcpmss
modprobe iptable_mangle
modprobe ipt_limit
modprobe ipt_tos
modprobe iptable_filter
modprobe ipt_helper
modprobe ipt_tos
modprobe ipt_ttl
modprobe ipt_REJECT
modprobe ipt_helper
modprobe ipt_owner
Next step is to enable these modules on the VPS.
Stop the container first : vzctl stop 960 ( replace 960 with the concerned VPS ID )
Execute the following command :
vzctl set 960 –iptables ipt_REJECT –iptables ipt_tos –iptables ipt_TOS –iptables ipt_LOG –iptables ip_conntrack –iptables ipt_limit –iptables ipt_multiport –iptables iptable_filter –iptables iptable_mangle –iptables ipt_TCPMSS –iptables ipt_tcpmss –iptables ipt_ttl –iptables ipt_length –iptables ipt_state –iptables iptable_nat –iptables ip_nat_ftp –iptables ip_conntrack_ftp –iptables ip_conntrack_irc –iptables ip_nat_irc –iptables ipt_owner –iptables ipt_helper –save
Start the container : vzctl start 960
check whether the modules are enabled from the configuration file cat /etc/vz/conf/960.conf. You are DONE.
Please note that if the command “vzctl set 960 –iptables ipt_ ….” is executed for the second time for the same VPS, it will over write the previous configuration.
For enabling it on all VPSes, please add to /etc/sysconfig/vz all those modules like IPTABLES=”module1 module2 ….etc”
