ConfigServer Security & Firewall (CSF) relies on several Linux iptables kernel modules<\/strong> to provide advanced firewall and security features. If some of these modules are unavailable, running the CSF test ( Although CSF can still function with basic firewall capabilities, features such as PORTFLOOD protection, PORTKNOCKING, SMTP_BLOCK, UID\/GID filtering, CONNLIMIT, and MESSENGER<\/strong> will not work until the required iptables modules are available. This guide explains how to identify the missing modules and resolve the issue on both physical servers and OpenVZ\/Virtuozzo VPS environments.<\/p>\n\n\n\n Before proceeding with the troubleshooting steps, ensure the following:<\/p>\n\n\n\n \u00a0<\/p>\n I have installed the CSF in the server. When I try to run the perl test in the CSF, it is giving the following error.<\/p>\n # ip_tables Following modules are used for the other functionality of csf<\/p>\n ipt_owner You can check if the above modules are installed in the server or not.<\/span><\/span><\/p>\n # If it is not installed then you can install it via You can test whether they have fixed the environment by running:<\/p>\n This will fix the issue.<\/p>\n In case of VPS like OpenVZ, Parallels Virtuozzo or etc, this might not been fixed some times. Just follow the steps below to fix the issue in the VPS container.<\/p>\n 1. 2. Edit \/etc\/sysconfig\/iptables-config<\/p>\n IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”<\/p>\n<\/blockquote>\n 3.Edit \/etc\/sysconfig\/vz<\/p>\n IPTABLES_MODULES=”ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ip_conntrack_ftp ipt_conntrack ip_tables ip_conntrack_netbios_ns”<\/p>\n<\/blockquote>\n 4. Execute the command in the console<\/p>\n \u00a0<\/p>\n<\/div>\ncsftest.pl<\/code>) will display errors such as:<\/p>\n\n\n\n\n
ipt_REDIRECT...FAILED<\/code><\/li>\n\n\n\nipt_owner...FAILED<\/code><\/li>\n\n\n\nipt_recent...FAILED<\/code><\/li>\n\n\n\niptable_nat...FAILED<\/code><\/li>\n<\/ul>\n\n\n\nPrerequisites
<\/h2>\n\n\n\n\n
iptables<\/code> package is installed and functioning.<\/li>\n\n\n\nIMPLEMENTATION<\/h2>\n\n\n
\n
perl \/etc\/csf\/<\/code>csftest.pl<\/code>
Testing ip_tables\/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport\/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state\/xt_state…OK
Testing ipt_limit\/xt_limit…OK
Testing ipt_recent…FAILED [Error: iptables: Unknown error 4294967295] – Required for PORTFLOOD and PORTKNOCKING features
Testing xt_connlimit…FAILED [Error: iptables: Unknown error 4294967295] – Required for CONNLIMIT feature
Testing ipt_owner\/xt_owner…FAILED [Error: iptables: Unknown error 4294967295] – Required for SMTP_BLOCK and UID\/GID blocking features
Testing iptable_nat\/ipt_REDIRECT…FAILED [Error: iptables: Unknown error 4294967295] – Required for MESSENGER feature
Testing iptable_nat\/ipt_DNAT…OKRESULT: csf will function on this server but some features will not work due to some missing iptables modules [4]<\/p>\n<\/blockquote>\n<\/div>\nSolution:<\/h4>\n<\/div>\n
\n
ipt_state
ipt_multiport
iptable_filter
ipt_limit
ipt_LOG
ipt_REJECT
ipt_conntrack
ip_conntrack
ip_conntrack_ftp
iptable_mangle<\/strong><\/p>\n<\/blockquote>\n\n
ipt_recent
iptable_nat
ipt_REDIRECT<\/strong><\/p>\n<\/blockquote>\nlsmod |grep -i module_name<\/code> <\/strong><\/p>\n
#modprob ipt_conntrack<\/code><\/strong><\/p>\nperl \/etc\/csf\/csftest.pl<\/code><\/strong><\/p>\n\/sbin\/iptables -F<\/code><\/p>\nvi \/etc\/sysconfig\/iptables-config<\/code><\/p>\n\n
vi \/etc\/sysconfig\/vz<\/code><\/p>\n\n
service vz stop<\/code><\/p>\nservice iptables restart<\/code><\/p>\nservice vz start<\/code><\/p>\n