inceptionhosting does not work iptables

Andr_C · January 2020

I use vps as a proxy. in the iptables settings is blocking some sites. before the openVZ update, everything worked well on the old version. but it’s not working now.

I am using this command:
iptables -A OUTPUT -m string --string "vk.com" --algo kmp --to 65535 -p all -j REJECT

everything worked on the old version but now displays an error message:
iptables: No chain/target/match by that name.

How to fix it?

My Node: Mininode1b (NETHERLANDS)
My IP: 192.168.1.101

kokkez · January 2020

I think you need to write this in a shell:
touch /option.netfilter

It will take up to 30 minutes, your server will restart.
When it has been done, the file option.netfilter will be renamed to netfilter.enabled

You can view a similar process, once logged in into the clientarea:
https://clients.inceptionhosting.com/index.php?rp=/knowledgebase/26/Enable-FUSE-or-NFS.html

Andr_C · January 2020

@kokkez said:
I think you need to write this in a shell:
touch /option.netfilter

I checked, it does not work. the result is the same - there is an error.
maybe something else is needed?

skorous · January 2020

I've never done --string matches. Does the rest of the config work if you remove those? If you just do a simple iptables --list what do you see?

Andr_C · January 2020

@skorous said:
I've never done --string matches. Does the rest of the config work if you remove those? If you just do a simple iptables --list what do you see?

all words in a line are required; you cannot delete a single word (cannot delete parameter -m string).
for iptables --list I see other rules, they work. only the module does not work -m string
before the update everything worked, now it doesn’t work

skorous · January 2020

Ah, so iptables as a whole does work. Just the string matching doesn't. ( Edited: because I didn't read the whole post )

skorous · January 2020

Just so the question has been asked, this is the same OS just migrated over to the new OVZ7 node or were you re-provisioned?

Andr_C · January 2020

@skorous said:
Just so the question has been asked, this is the same OS just migrated over to the new OVZ7 node or were you re-provisioned?

all the same, nothing has changed. just changed OpenVZ and I did a system update (apt update; apt upgrade).

Clouvider · January 2020

Presumably module not loaded in the kernel. It’s not quite basic one either. One that’s quite taxing as well. Perhaps @AnthonySmith will oblige and load, otherwise you shouldn’t have any hard feelings here.

WSS · January 2020

That used to be xt_string but I haven't played with OVZ7 much.. nor used strings fro this.

InceptionHosting · January 2020

I will have a look into what is missing tomorrow.

InceptionHosting · January 2020

Ok had a look, it is still xt_string which is loaded on the host node.

Did some reading, not much new info available but it looks like this used to be a common issue on vz6 too, unloading xt_string and then reloading it via probing for ipt_string was the suggested solution.

I have now done that and can see that xt_string is present.

I would suggest that you stop your container completely via solusvm then start it via solusvm.

check again and throw a -v after iptables in the command and paste the results if it is still failing, it is quite possible the module is not the issue here.

Andr_C · January 2020

@AnthonySmith said:
Ok had a look, it is still xt_string which is loaded on the host node.

through the solusvm menu I turned on and off VPS.
I see the module "string" in the file /proc/net/ip_tables_matches

but the firewall is not working:
# iptables -v -A OUTPUT -m string --string "vk.com" --algo kmp --to 65535 -p all -j REJECT
REJECT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 STRING match "vk.com" ALGO name kmp TO 65535 reject-with icmp-port-unreachable
iptables: No chain/target/match by that name.

InceptionHosting · January 2020

Not sure what to tell you, the module is loaded and available, I will take another look though.

abnoeh · January 2020

Is that iptable real iptable, or nftable emulating it? Default is nft translation layer, right?

Andr_C · January 2020

@abnoeh said:
Is that iptable real iptable, or nftable emulating it? Default is nft translation layer, right?

I have not used anywhere nftable, use only iptable. maybe OVZ7 replaces, but I'm not sure

Andr_C · January 2020

@AnthonySmith said:
Not sure what to tell you, the module is loaded and available, I will take another look though.

you may need to update openvz, there are no problems with the latest version. I don't have the last one. can you update openvz?
https://bugs.openvz.org/browse/OVZ-7171

InceptionHosting · January 2020

There you go then, options right now:

Use a CentOS 7 container or wait for the next update/reboot.

Andr_C · January 2020

@AnthonySmith said:
wait for the next update/reboot.

OK. tell me when the planned next upgrade?

InceptionHosting · January 2020

@Andr_C said:

@AnthonySmith said:
wait for the next update/reboot.

OK. tell me when the planned next upgrade?

There are none planned right now.

Andr_C · January 2020

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

InceptionHosting · January 2020

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

WSS · January 2020

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

angstrom · January 2020

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Neoon · January 2020

@angstrom said:

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Yes INDEED it is, APPARENTLY.

angstrom · January 2020

@Neoon said:

@angstrom said:

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Yes INDEED it is, APPARENTLY.

Why "apparently"? Do you have a reference? (It's a sincere question.)

sonic · January 2020

@angstrom said:

@Neoon said:

@angstrom said:

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Yes INDEED it is, APPARENTLY.

Why "apparently"? Do you have a reference? (It's a sincere question.)

Daniel · January 2020

@angstrom said: is KernelCare available for the OpenVZ kernel?

Indeed it is, even for legacy OpenVZ6:

You can see a full list of supported kernels here: https://patches.kernelcare.com/

angstrom · January 2020

@sonic, @Daniel

Thanks. Yes, I was aware of OVZ6 support. I was interested in whether KernelCare supports the OVZ7 kernel. Perhaps I should have clarified this, but the topic of this thread is OVZ7.

I'm still wondering, though: I can't seem to find the OVZ7 kernel on https://patches.kernelcare.com/#All Kernels/ . But perhaps I'm missing something.

InceptionHosting · January 2020

3 points.

I don’t believe Kcare supports virtuozzo kernels.
I removed Kcare from all of the vz6 nodes due to stability issues.
Out of all of the containers on the NAT OpenVZ service (thousands) this is a single lone report, with a ‘should fix’ and work around in the bug report so I can’t justify a full node reboot just for that, you pick OpenVZ and you accept some limitations.

That said, frankly OpenVZ 7 is not that stable generally yet, I mean it’s ok but it’s about at the stage of 80% that both VZ5 and VZ6 were at this stage in their life, so a reboot may be inevitable way sooner, the updates (with no guarantee of a fix) have been applied in advance should that happen.

Andr_C · January 2020

@AnthonySmith said: reboot may be inevitable way sooner, the updates

I will wait for the update and reboot of the new kernel. it can wait. there is a problem, but it is not very big.
the problem can be closed I am waiting for an update.

WSS · January 2020

@AnthonySmith said:
3 points.

I don’t believe Kcare supports virtuozzo kernels.

I removed Kcare from all of the vz6 nodes due to stability issues.

Out of all of the containers on the NAT OpenVZ service (thousands) this is a single lone report, with a ‘should fix’ and work around in the bug report so I can’t justify a full node reboot just for that, you pick OpenVZ and you accept some limitations.

1) No

2) You need to keep control of your drivers outside of the kernel, if not stock, and still, even so.

3) Agreed.

Falzo · January 2020

InceptionHosting · January 2020

@Falzo said:

Yep, that has been covered and is now standard on all vz7 containers and user managed for all migrated vz6 containers.

inceptionhosting does not work iptables

Comments