Introduction
ConfigServer Security & Firewall (CSF) uses iptables modules to provide firewall protection and additional security features. After installing CSF, you can verify whether the required iptables modules are available by running the CSF test script:
perl /etc/csf/csftest.pl
If some modules are missing, the test may return errors such as:
Testing ipt_recent...FAILED Testing xt_connlimit...FAILED Testing ipt_owner/xt_owner...FAILED Testing iptable_nat/ipt_REDIRECT...FAILED
CSF may still function, but features such as PORTFLOOD, PORTKNOCKING, CONNLIMIT, SMTP_BLOCK, UID/GID blocking, and MESSENGER may not work.
This guide explains how to identify and load the required iptables modules and how to resolve the issue, including in VPS environments such as OpenVZ or Virtuozzo.
Prerequisites
Before starting, make sure you have:
- Root or sudo access to the server.
- CSF installed on the server.
- Access to the server console or SSH.
- Basic knowledge of Linux commands.
- A backup or recovery method available before making firewall changes.
Implementation
I have installed CSF on the server. When I try to run the Perl test in CSF, it gives the following error.
#
perl /etc/csf/csftest.pl
Testing ip_tables/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state/xt_state…OK
Testing ipt_limit/xt_limit…OK
Testing ipt_recent…FAILED [Error: iptables: Unknown error 4294967295] – Required for PORTFLOOD and PORTKNOCKING features
Testing xt_connlimit…FAILED [Error: iptables: Unknown error 4294967295] – Required for CONNLIMIT feature
Testing ipt_owner/xt_owner…FAILED [Error: iptables: Unknown error 4294967295] – Required for SMTP_BLOCK and UID/GID blocking features
Testing iptable_nat/ipt_REDIRECT…FAILED [Error: iptables: Unknown error 4294967295] – Required for MESSENGER feature
Testing iptable_nat/ipt_DNAT…OKRESULT: csf will function on this server but some features will not work due to some missing iptables modules [4]
Solution:
ip_tables
ipt_state
ipt_multiport
iptable_filter
ipt_limit
ipt_LOG
ipt_REJECT
ipt_conntrack
ip_conntrack
ip_conntrack_ftp
iptable_mangle
The following modules are used for the other functionality of CSF
ipt_owner
ipt_recent
iptable_nat
ipt_REDIRECT
You can check if the above modules are installed in the server or not.
# lsmod |grep -i module_name
If it is not installed, then you can install it via
#modprob ipt_conntrack
You can test whether they have fixed the environment by running:
perl /etc/csf/csftest.pl
This will fix the issue.
In the case of VPS like OpenVZ, Parallels Virtuozzo, etc, this might not be fixed sometimes. Just follow the steps below to fix the issue in the VPS container.
1. /sbin/iptables -F
2. Edit /etc/sysconfig/iptables-config
vi /etc/sysconfig/iptables-config
IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”
3. Edit /etc/sysconfig/vz
vi /etc/sysconfig/vz
IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”
4. Execute the command in the console
service vz stop
service iptables restart
service vz start
Conclusion
The CSF test script is useful for identifying missing iptables functionality after CSF installation. If modules such as ipt_recent, xt_connlimit, xt_owner, or iptable_nat are unavailable, CSF may continue to operate, but some advanced features will not function.
First, verify the installed kernel and firewall backend, check whether the required modules are available, and load them with modprobe when supported. For container-based VPS environments such as OpenVZ or Virtuozzo, the required functionality may need to be enabled at the host-node level.
Finally, run:
perl /etc/csf/csftest.pl
again and confirm that the required tests return OK before enabling or relying on the affected CSF features.
FQAs
1. How do I check missing CSF iptables modules?
Run perl /etc/csf/csftest.pl to identify unavailable modules.
2. What should I do if an iptables module is missing?
Check the module with lsmod and load it using modprobe if supported.
3. How can I verify the fix?
Run the CSF test again and confirm the required checks show OK.
Talk to our experts:
Looking for the right technology solution for your business?. Our experts can help with web hosting, domain registration, DevOps and cloud, software development, web applications, mobile applications, and enterprise solutions. Get in touch with our team here.