Introduction

ConfigServer Security & Firewall (CSF) relies on several Linux iptables kernel modules to provide advanced firewall and security features. If some of these modules are unavailable, running the CSF test (csftest.pl) will display errors such as:

  • ipt_REDIRECT...FAILED
  • ipt_owner...FAILED
  • ipt_recent...FAILED
  • iptable_nat...FAILED

Although CSF can still function with basic firewall capabilities, features such as PORTFLOOD protection, PORTKNOCKING, SMTP_BLOCK, UID/GID filtering, CONNLIMIT, and MESSENGER will not work until the required iptables modules are available. This guide explains how to identify the missing modules and resolve the issue on both physical servers and OpenVZ/Virtuozzo VPS environments.

Prerequisites

Before proceeding with the troubleshooting steps, ensure the following:

  • CSF is installed on the server.
  • Root or sudo access to the server.
  • The iptables package is installed and functioning.
  • Basic knowledge of Linux command-line operations.
  • Access to the host node if the server is running on an OpenVZ/Virtuozzo VPS (some kernel modules must be enabled by the VPS provider).
  • It is recommended to back up the current firewall configuration before making any changes.

IMPLEMENTATION

 

I have installed the CSF in the server. When I try to run the perl test in the CSF, it is giving the following error.

# perl /etc/csf/csftest.pl
Testing ip_tables/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state/xt_state…OK
Testing ipt_limit/xt_limit…OK
Testing ipt_recent…FAILED [Error: iptables: Unknown error 4294967295] – Required for PORTFLOOD and PORTKNOCKING features
Testing xt_connlimit…FAILED [Error: iptables: Unknown error 4294967295] – Required for CONNLIMIT feature
Testing ipt_owner/xt_owner…FAILED [Error: iptables: Unknown error 4294967295] – Required for SMTP_BLOCK and UID/GID blocking features
Testing iptable_nat/ipt_REDIRECT…FAILED [Error: iptables: Unknown error 4294967295] – Required for MESSENGER feature
Testing iptable_nat/ipt_DNAT…OKRESULT: csf will function on this server but some features will not work due to some missing iptables modules [4]

Solution:

csf requires at least these iptables modules in the main node

ip_tables
ipt_state
ipt_multiport
iptable_filter
ipt_limit
ipt_LOG
ipt_REJECT
ipt_conntrack
ip_conntrack
ip_conntrack_ftp
iptable_mangle

Following modules are used for the other functionality of csf

ipt_owner
ipt_recent
iptable_nat
ipt_REDIRECT

You can check if the above modules are installed in the server or not.

# lsmod |grep -i module_name

If it is not installed then you can install it via

#modprob ipt_conntrack

You can test whether they have fixed the environment by running:

perl /etc/csf/csftest.pl

This will fix the issue.

In case of VPS like OpenVZ, Parallels Virtuozzo or etc, this might not been fixed some times. Just follow the steps below to fix the issue in the VPS container.

1. /sbin/iptables -F

2. Edit /etc/sysconfig/iptables-config

vi /etc/sysconfig/iptables-config

IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”

3.Edit /etc/sysconfig/vz

vi /etc/sysconfig/vz

IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”

4. Execute the command in the console

service vz stop

service iptables restart

service vz start

 

 
 
 

Conclusion

Missing iptables kernel modules can prevent several advanced CSF security features from functioning correctly. By verifying the required modules, loading any missing modules with modprobe, and rerunning the CSF test, most issues can be resolved on dedicated or virtual servers. In OpenVZ or Virtuozzo environments, additional configuration on the host node may be necessary since the required kernel modules are managed by the virtualization host. After completing the configuration, rerun perl /etc/csf/csftest.pl to confirm that all required modules are available and that CSF is operating with full functionality.

Post Views: 201

Leave a Reply