inceptionhosting does not work iptables

Andr_C · January 2020

I use vps as a proxy. in the iptables settings is blocking some sites. before the openVZ update, everything worked well on the old version. but it’s not working now.

I am using this command:
iptables -A OUTPUT -m string --string "vk.com" --algo kmp --to 65535 -p all -j REJECT

everything worked on the old version but now displays an error message:
iptables: No chain/target/match by that name.

How to fix it?

My Node: Mininode1b (NETHERLANDS)
My IP: 192.168.1.101

kokkez · January 2020

I think you need to write this in a shell:
touch /option.netfilter

It will take up to 30 minutes, your server will restart.
When it has been done, the file option.netfilter will be renamed to netfilter.enabled

You can view a similar process, once logged in into the clientarea:
https://clients.inceptionhosting.com/index.php?rp=/knowledgebase/26/Enable-FUSE-or-NFS.html

Andr_C · January 2020

@kokkez said:
I think you need to write this in a shell:
touch /option.netfilter

I checked, it does not work. the result is the same - there is an error.
maybe something else is needed?

skorous · January 2020

I've never done --string matches. Does the rest of the config work if you remove those? If you just do a simple iptables --list what do you see?

Andr_C · January 2020

@skorous said:
I've never done --string matches. Does the rest of the config work if you remove those? If you just do a simple iptables --list what do you see?

all words in a line are required; you cannot delete a single word (cannot delete parameter -m string).
for iptables --list I see other rules, they work. only the module does not work -m string
before the update everything worked, now it doesn’t work

skorous · January 2020

Ah, so iptables as a whole does work. Just the string matching doesn't. ( Edited: because I didn't read the whole post )

skorous · January 2020

Just so the question has been asked, this is the same OS just migrated over to the new OVZ7 node or were you re-provisioned?

Andr_C · January 2020

@skorous said:
Just so the question has been asked, this is the same OS just migrated over to the new OVZ7 node or were you re-provisioned?

all the same, nothing has changed. just changed OpenVZ and I did a system update (apt update; apt upgrade).

Clouvider · January 2020

Presumably module not loaded in the kernel. It’s not quite basic one either. One that’s quite taxing as well. Perhaps @AnthonySmith will oblige and load, otherwise you shouldn’t have any hard feelings here.

WSS · January 2020

That used to be xt_string but I haven't played with OVZ7 much.. nor used strings fro this.

InceptionHosting · January 2020

I will have a look into what is missing tomorrow.

InceptionHosting · January 2020

Ok had a look, it is still xt_string which is loaded on the host node.

Did some reading, not much new info available but it looks like this used to be a common issue on vz6 too, unloading xt_string and then reloading it via probing for ipt_string was the suggested solution.

I have now done that and can see that xt_string is present.

I would suggest that you stop your container completely via solusvm then start it via solusvm.

check again and throw a -v after iptables in the command and paste the results if it is still failing, it is quite possible the module is not the issue here.

Andr_C · January 2020

@AnthonySmith said:
Ok had a look, it is still xt_string which is loaded on the host node.

through the solusvm menu I turned on and off VPS.
I see the module "string" in the file /proc/net/ip_tables_matches

but the firewall is not working:
# iptables -v -A OUTPUT -m string --string "vk.com" --algo kmp --to 65535 -p all -j REJECT
REJECT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 STRING match "vk.com" ALGO name kmp TO 65535 reject-with icmp-port-unreachable
iptables: No chain/target/match by that name.

InceptionHosting · January 2020

Not sure what to tell you, the module is loaded and available, I will take another look though.

abnoeh · January 2020

Is that iptable real iptable, or nftable emulating it? Default is nft translation layer, right?

Andr_C · January 2020

@abnoeh said:
Is that iptable real iptable, or nftable emulating it? Default is nft translation layer, right?

I have not used anywhere nftable, use only iptable. maybe OVZ7 replaces, but I'm not sure

Andr_C · January 2020

@AnthonySmith said:
Not sure what to tell you, the module is loaded and available, I will take another look though.

you may need to update openvz, there are no problems with the latest version. I don't have the last one. can you update openvz?
https://bugs.openvz.org/browse/OVZ-7171

InceptionHosting · January 2020

There you go then, options right now:

Use a CentOS 7 container or wait for the next update/reboot.

Andr_C · January 2020

@AnthonySmith said:
wait for the next update/reboot.

OK. tell me when the planned next upgrade?

InceptionHosting · January 2020

@Andr_C said:

@AnthonySmith said:
wait for the next update/reboot.

OK. tell me when the planned next upgrade?

There are none planned right now.

Andr_C · January 2020

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

InceptionHosting · January 2020

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

WSS · January 2020

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

angstrom · January 2020

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Neoon · January 2020

@angstrom said:

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Yes INDEED it is, APPARENTLY.

angstrom · January 2020

@Neoon said:

@angstrom said:

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Yes INDEED it is, APPARENTLY.

Why "apparently"? Do you have a reference? (It's a sincere question.)

sonic · January 2020

@angstrom said:

@Neoon said:

@angstrom said:

@WSS said:

@AnthonySmith said:

@Andr_C said:

@AnthonySmith said: There are none planned right now.

tell me at least approximate dates (six months or a year).

about that, maybe sooner.

I'd just pay $5/mo for KernelCare and let it roll.

Just curious: is KernelCare available for the OpenVZ kernel?

Yes INDEED it is, APPARENTLY.

Why "apparently"? Do you have a reference? (It's a sincere question.)

Daniel · January 2020

@angstrom said: is KernelCare available for the OpenVZ kernel?

Indeed it is, even for legacy OpenVZ6:

You can see a full list of supported kernels here: https://patches.kernelcare.com/

angstrom · January 2020

@sonic, @Daniel

Thanks. Yes, I was aware of OVZ6 support. I was interested in whether KernelCare supports the OVZ7 kernel. Perhaps I should have clarified this, but the topic of this thread is OVZ7.

I'm still wondering, though: I can't seem to find the OVZ7 kernel on https://patches.kernelcare.com/#All Kernels/ . But perhaps I'm missing something.

InceptionHosting · January 2020

3 points.

I don’t believe Kcare supports virtuozzo kernels.
I removed Kcare from all of the vz6 nodes due to stability issues.
Out of all of the containers on the NAT OpenVZ service (thousands) this is a single lone report, with a ‘should fix’ and work around in the bug report so I can’t justify a full node reboot just for that, you pick OpenVZ and you accept some limitations.

That said, frankly OpenVZ 7 is not that stable generally yet, I mean it’s ok but it’s about at the stage of 80% that both VZ5 and VZ6 were at this stage in their life, so a reboot may be inevitable way sooner, the updates (with no guarantee of a fix) have been applied in advance should that happen.

Andr_C · January 2020

@AnthonySmith said: reboot may be inevitable way sooner, the updates

I will wait for the update and reboot of the new kernel. it can wait. there is a problem, but it is not very big.
the problem can be closed I am waiting for an update.

inceptionhosting does not work iptables

Comments