ConfigServer Security & Firewall (CSF) uses iptables<\/strong> modules to provide firewall protection and additional security features. After installing CSF, you can verify whether the required iptables modules are available by running the CSF test script:<\/p>\n\n\n\n If some modules are missing, the test may return errors such as:<\/p>\n\n\n\n CSF may still function, but features such as PORTFLOOD, PORTKNOCKING, CONNLIMIT, SMTP_BLOCK, UID\/GID blocking, and MESSENGER<\/strong> may not work.<\/p>\n\n\n\n This guide explains how to identify and load the required iptables modules and how to resolve the issue, including in VPS environments such as OpenVZ or Virtuozzo.<\/p>\n\n\n\n Before starting, make sure you have:<\/p>\n\n\n\n I have installed CSF on the server. When I try to run the Perl test in CSF, it gives the following error.<\/p>\n # ip_tables The following modules are used for the other functionality of CSF<\/p>\n ipt_owner You can check if the above modules are installed in the server or not.<\/span><\/span><\/p>\n # If it is not installed, then you can install it via You can test whether they have fixed the environment by running:<\/p>\n This will fix the issue.<\/p>\n In the case of VPS like OpenVZ, Parallels Virtuozzo, etc, this might not be fixed sometimes. Just follow the steps below to fix the issue in the VPS container.<\/p>\n 1. 2. Edit \/etc\/sysconfig\/iptables-config<\/p>\n IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”<\/p>\n<\/blockquote>\n 3. Edit \/etc\/sysconfig\/vz<\/p>\n IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”<\/p>\n<\/blockquote>\n 4. Execute the command in the console<\/p>\n The CSF test script is useful for identifying missing iptables functionality after CSF installation. If modules such as First, verify the installed kernel and firewall backend, check whether the required modules are available, and load them with Finally, run:<\/p>\n\n\n\n again and confirm that the required tests return 1. How do I check missing CSF iptables modules?<\/strong> 2. What should I do if an iptables module is missing?<\/strong>perl \/etc\/csf\/csftest.pl<\/pre>\n\n\n\n
Testing ipt_recent...FAILED\nTesting xt_connlimit...FAILED\nTesting ipt_owner\/xt_owner...FAILED\nTesting iptable_nat\/ipt_REDIRECT...FAILED<\/pre>\n\n\n\n
Prerequisites<\/h2>\n\n\n\n
\n
Implementation<\/strong><\/h2>\n\n\n
\n
perl \/etc\/csf\/<\/code>csftest.pl<\/code>
Testing ip_tables\/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport\/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state\/xt_state…OK
Testing ipt_limit\/xt_limit…OK
Testing ipt_recent…FAILED [Error: iptables: Unknown error 4294967295] – Required for PORTFLOOD and PORTKNOCKING features
Testing xt_connlimit…FAILED [Error: iptables: Unknown error 4294967295] – Required for CONNLIMIT feature
Testing ipt_owner\/xt_owner…FAILED [Error: iptables: Unknown error 4294967295] – Required for SMTP_BLOCK and UID\/GID blocking features
Testing iptable_nat\/ipt_REDIRECT…FAILED [Error: iptables: Unknown error 4294967295] – Required for MESSENGER feature
Testing iptable_nat\/ipt_DNAT…OKRESULT: csf will function on this server but some features will not work due to some missing iptables modules [4]<\/p>\n<\/blockquote>\n<\/div>\nSolution:<\/h4>\n<\/div>\n
\n
ipt_state
ipt_multiport
iptable_filter
ipt_limit
ipt_LOG
ipt_REJECT
ipt_conntrack
ip_conntrack
ip_conntrack_ftp
iptable_mangle<\/strong><\/p>\n<\/blockquote>\n\n
ipt_recent
iptable_nat
ipt_REDIRECT<\/strong><\/p>\n<\/blockquote>\nlsmod |grep -i module_name<\/code> <\/strong><\/p>\n
#modprob ipt_conntrack<\/code><\/strong><\/p>\nperl \/etc\/csf\/csftest.pl<\/code><\/strong><\/p>\n\/sbin\/iptables -F<\/code><\/p>\nvi \/etc\/sysconfig\/iptables-config<\/code><\/p>\n\n
vi \/etc\/sysconfig\/vz<\/code><\/p>\n\n
service vz stop<\/code><\/p>\nservice iptables restart<\/code><\/p>\nservice vz start<\/code><\/p>\n<\/div>\n\n\nConclusion<\/h2>\n\n\n\n
ipt_recent<\/code>, xt_connlimit<\/code>, xt_owner<\/code>, or iptable_nat<\/code> are unavailable, CSF may continue to operate, but some advanced features will not function.<\/p>\n\n\n\nmodprobe<\/code> when supported. For container-based VPS environments such as OpenVZ or Virtuozzo, the required functionality may need to be enabled at the host-node level.<\/p>\n\n\n\nperl \/etc\/csf\/csftest.pl<\/pre>\n\n\n\n
OK<\/code> before enabling or relying on the affected CSF features.<\/p>\n\n\n\nFQAs<\/h3>\n\n\n\n
Run perl \/etc\/csf\/csftest.pl<\/code> to identify unavailable modules.<\/p>\n\n\n\n
Check the module with lsmod<\/code> and load it using modprobe<\/code> if supported.<\/p>\n\n\n\n