|
| Re: Firewall for LXAdmin [message #6341 is a reply to message #6329] |
Sat, 09 June 2007 21:23   |
Lxhelp Messages: 23691 Registered: July 2006 |
The Champion |
|
|
| Quote: |
>
>
> Hello I am curious what firewall you recommend using with LXAdmin. I am familiar with securing cpanel and directadmin, but lxadmin is new to me. I am guessing APF would work good with LXAdmin. Do you have any other suggestions? What ports need to be left open in lxadmin? Do you know of a good tutorial?
>
> Thanks for your help.
|
APF seems to be the most commonly used one, and it should work fine with lxadmin. You need to have 7777/7778 ports for web access and 7779 for internal and external communication. Opening these ports should be enough.
There are no tutorials for firewall and lxadmin available at this point, but we will have some guidelines for securing Lxadmin, and will also include some of it into the CP itself.
Thanks.
|
|
|
| Re: Firewall for LXAdmin [message #6417 is a reply to message #6329] |
Mon, 11 June 2007 05:40   |
Galaxy Hosts  Messages: 18 Registered: June 2007 |
Member |
|
|
This may help, I have modified a tutorial for apf so it will work for LXAdmin. If you see any changes that need to be made let me know.
Important: Be sure Iptables were enabled when the VM was created (openvz)
1. cd /root/downloads or another temporary folder where you store your files.
2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
3. tar -xvzf apf-current.tar.gz
4. cd apf-0.9.6-2/ or whatever the latest version is.
5. Run the install file: ./install.sh
You will receive a message saying it has been installed
Installing APF 0.9.6-2: Completed.
Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/
Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,7776,7777,7778, 7779,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.
6. Lets configure the firewall: pico /etc/apf/conf.apf (or nano /etc/apf/conf.apf)
We will go over the general configuration to get your firewall running. This isn't a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.
We like to use DShield.org's "block" list of top networks that have exhibited
suspicious activity.
FIND: USE_DS="0"
CHANGE TO: USE_DS="1"
Find the following lines:
IFACE_IN="eth0"
IFACE_OUT="eth0"
and change them to
IFACE_IN="venet0"
IFACE_OUT="venet0"
7. Configuring Firewall Ports:
LxAdmin Servers
We like to use the following on our Cpanel Servers
Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,7777,7778,7779,3000_3500 "
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"
Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"
# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43,7777,7778,7779"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"
Save the changes: Ctrl+X then Y
8. Starting the firewall
/usr/local/sbin/apf -s
Other commands:
usage ./apf [OPTION]
-s|--start ......................... load firewall policies
-r|--restart ....................... flush & load firewall
-f|--flush|--stop .................. flush firewall
-l|--list .......................... list chain rules
-st|--status ....................... firewall status
-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall
9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.
pico /etc/apf/conf.apf
FIND: DEVM="1"
CHANGE TO: DEVM="0"
10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!
pico /etc/apf/ad/conf.antidos
There are various things you might want to fiddle with but I'll get the ones that will alert you by email.
# [E-Mail Alerts]
Under this heading we have the following:
# Organization name to display on outgoing alert emails
CONAME="Your Company"
Enter your company information name or server name..
# Send out user defined attack alerts [0=off,1=on]
USR_ALERT="0"
Change this to 1 to get email alerts
# User for alerts to be mailed to
USR="your@email.com"
Enter your email address to receive the alerts
Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r
11. Checking the APF Log
Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log
Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123
12. New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:
chkconfig --level 2345 apf on
To remove it from autostart, run this:
chkconfig --del apf
13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I'll show you 2 of the easier methods.
A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they're instantly active.
Example:
./apf -d 185.14.157.123 TESTING
pico /etc/apf/deny_hosts.rules
Shows the following:
# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123
B) pico /etc/apf/deny_hosts.rules
You can then just add a new line and enter the IP you wish to block. Before this becomes active though you'll need to reload the APF ruleset.
/etc/apf/apf -r
14. Allowing IPs with APF Firewall (Unblocking)
I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules
Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.
/etc/apf/apf -r
B) If the IP isn't already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules
/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they're instantly active.
Example:
./apf -a 185.14.157.123 UNBLOCKING
pico /etc/apf/allow_hosts.rules
# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123
[Updated on: Mon, 11 June 2007 05:48] Report message to a moderator
|
|
|
|
| Re: Firewall for LXAdmin [message #6420 is a reply to message #6419] |
Mon, 11 June 2007 05:56   |
Lxhelp Messages: 23691 Registered: July 2006 |
The Champion |
|
|
| Quote: |
>
>
> Now I am trying to install this on a VM that does not have Iptables enabled and it will not let me simply chech the box in hyper vm to enable it. I would rather not delete and remake the VM if I cab help it. Any suggestions?
|
That means that the client who is owning the vm doesn't have the specified permission. So go the client home -> limit and enable it first.
Thanks.
|
|
|
|
|
| Re: Firewall for LXAdmin [message #9381 is a reply to message #6329] |
Thu, 26 July 2007 07:30   |
alja  Messages: 192 Registered: July 2007 |
Senior Member |
|
|
Hi, I have followed all the steps but now I cannot access the Lxadmin service. I have added the ports as stated in the how to but I don't know what I'm doing wrong.
Thanks.
Edit> I can login using only the https and port 7777
[Updated on: Thu, 26 July 2007 07:32] Report message to a moderator
|
|
|
|
|
|
| Re: Firewall for LXAdmin [message #16625 is a reply to message #6329] |
Sun, 11 November 2007 06:12   |
crankshaft  Messages: 145 Registered: November 2007 |
Valuable Member |
|
|
Hi;
Thanks for the guide, I have setup & configured as per your guide, I have also removed port 7778 from P2P, however when I try and startup I get the following error:
Starting APF:apf(16231): {glob} activating firewall
apf(16273): {glob} unable to load iptables module (ip_tables), aborting.
apf(16231): {glob} firewall initalized
apf(16231): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.
If I SET_MONOKERN="1" (to overcome the unable to load iptables module (ip_tables), aborting), it starts up but blocks all ports for 5 minutes until it shuts down (in development mode)
Any ideas ??
[Updated on: Sun, 11 November 2007 07:06] Report message to a moderator
|
|
|
|
| Re: Firewall for LXAdmin [message #16662 is a reply to message #6329] |
Sun, 11 November 2007 21:42   |
crankshaft  Messages: 145 Registered: November 2007 |
Valuable Member |
|
|
Ahh, solved it, my error.
I had the following:
IG_TCP_CPORTS="21,22,25,53,80,443,110,143,7777,7778,7779,3000_3500"
IG_UDP_CPORTS="53"
IG_ICMP_TYPES="3,5,11,0,30,8"
# Common inbound (ingress) TCP ports
IG_TCP_CPORTS="22"
# Common inbound (ingress) UDP ports
IG_UDP_CPORTS=""
Which meant that the second occurence of IG_XXX_CPORTS over-wrote the first, i.e. only port 22 was opened !
Thanks
|
|
|
| Re: Firewall for LXAdmin [message #16947 is a reply to message #6329] |
Tue, 20 November 2007 12:43   |
|
Hello a nubbie to vps here,
I am going to make myself sound stupid, but could someone please advise me where I would upload the files for apf?
Would I be right in assuming I should rename the unzipped file to apf and upload it into my etc folder?
And how I access the ./install.sh Is this via the hyper vm console access or command centre ?
Or am I totally off track, I can pretty much follow the above guide if my few questions are answered.
Suppose we all have to start somewhere lol.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Re: Firewall for LXAdmin [message #32970 is a reply to message #6329] |
Thu, 10 July 2008 09:39   |
nimbar  Messages: 4 Registered: July 2008 Location: Gijón, Spain |
Member |
|
|
CSF+LFD AND LXADMIN
Dear friends,
This is a tutorial to install ConfigServer Security and Firewall which is one of the most robust an free firewall softwares out there. It was designed for cPanel servers, but you can use it with your lxadmin system. Here we go:
1.- Follow the instructions provided here
2.- Once the firewall is installed, enter your server with your favourite SSH client: Putty, XShell or even WinSCP.
3.- Go to /etc/csf and edit csf.conf. Don't forget to open the ports 7777, 7778, 7779 and 5555. Configure the rest at your desires.
4.- Have PT_USERKILL = "1" enabled means the firewall will check for suspicious processes and will kill them. You would need to add an exception for lxadmin interface, mysql, tinydns, qmail and clamav, otherwise the processes will be killed and you will be very upset trying to figure out why lxadmin stops from time to time without any aparent reason.
5.- Ok, then go to csf.pignore and add:
user:lxlabs
user:clamav
user:mysql
user:tinydns
user:qmails
user:qmaill
user:qmailq
user:qmailr
(empty line here)
6.- Restart services by doing
service csf restart
service lfd restart
All done!
Greetings from Gijón and thanks Marie!.
Nimbar - Ayuda en español
Need Further Assistance ? Here you go ! !
[Updated on: Mon, 14 July 2008 08:27] Report message to a moderator
|
|
|
|
| Re: Firewall for LXAdmin [message #33541 is a reply to message #6329] |
Mon, 21 July 2008 17:50   |
|
Hi Ive just installed apf 0.9.6-3 on my server
ip_tables is enabled when i check the service listing green light shows.
but when I start apf in devel mode I get the following message
error fetching interface information: Device not found
apf(23657): {glob} activating firewall
0: error fetching interface information: Device not found
0: error fetching interface information: Device not found
apf(23703): {glob} unable to load iptables module (ip_tables), aborting.
apf(23657): {glob} firewall initalized
apf(23657): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.
-bash-3.1#
Wonder if anyone has any suggestions as to where Im going wrong?
Also both of below do not seem to be there when I goto edit the conf.antidos
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
any assistance is appreciated
|
|
|
|
| Re: Firewall for LXAdmin [message #33565 is a reply to message #33557] |
Tue, 22 July 2008 06:45   |
|
| evolnick wrote on Tue, 22 July 2008 02:41 | did you set the IFACE_IN and IFACE_OUT to "venet0"?
and i think antidos has been removed: "scrub of APF to remove all ties to antidos, the antidos subsystem has been removed and will be replaced with expanded RAB features".
see http://rfxnetworks.com/appdocs/CHANGELOG.apf
|
Hi
thanks for your reply. I had not set the IFACE_IN AND IFACE_OUT TO "venet".
I have now but I am still having a problem
apf(25680): {glob} activating firewall
apf(25722): {glob} unable to load iptables module (ip_tables), aborting.
apf(25680): {glob} firewall initalized
apf(25680): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.
Is there anything else I could be missing?
|
|
|
|
| Re: Firewall for LXAdmin [message #33572 is a reply to message #33568] |
Tue, 22 July 2008 10:13   |
|
| evolnick wrote on Tue, 22 July 2008 09:14 | try to set SET_MONOKERN to "1" ( in /etc/apf/apf.conf )
tip: if you search this in google, you could have seen it too ( example search for 'apf ip_tables' )
|
Thanks but I already tried that after reading other posts on this forum and I got the following
apf(5966): {glob} activating firewall
apf(6006): {glob} determined (IFACE_IN) venet0 has address 127.0.0.1
apf(6006): {glob} determined (IFACE_OUT) venet0 has address 127.0.0.1
apf(6006): {glob} loading preroute.rules
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {resnet} downloading http://r-fx.ca/downloads/reserved.networks
apf(6006): {resnet} parsing reserved.networks into /etc/apf/internals/reserved.networks
apf(6006): {glob} loading reserved.networks
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables v1.3.5: Couldn't load target `TALLOW':/lib/iptables/libipt_TALLOW.so: cannot ope
n shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TALLOW':/lib/iptables/libipt_TALLOW.so: cannot ope
n shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TDENY':/lib/iptables/libipt_TDENY.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TDENY':/lib/iptables/libipt_TDENY.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGALLOW':/lib/iptables/libipt_TGALLOW.so: cannot o
pen shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGALLOW':/lib/iptables/libipt_TGALLOW.so: cannot o
pen shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGDENY':/lib/iptables/libipt_TGDENY.so: cannot ope
n shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGDENY':/lib/iptables/libipt_TGDENY.so: cannot ope
n shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {glob} SET_REFRESH is set to 10 minutes
apf(6006): {glob} loading bt.rules
apf(6006): {dshield} downloading http://feeds.dshield.org/top10-2.txt
apf(6006): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules
apf(6006): {dshield} loading ds_hosts.rules
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `DSHIELD':/lib/iptables/libipt_DSHIELD.so: cannot o
pen shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `DSHIELD':/lib/iptables/libipt_DSHIELD.so: cannot o
pen shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {sdrop} downloading http://www.spamhaus.org/drop/drop.lasso
apf(6006): {sdrop} parsing drop.lasso into /etc/apf/sdrop_hosts.rules
apf(6006): {sdrop} loading sdrop_hosts.rules
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `SDROP':/lib/iptables/libipt_SDROP.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `SDROP':/lib/iptables/libipt_SDROP.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {glob} loading common drop ports
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 135:139
apf(6006): {blk_ports} deny all to/from udp port 135:139
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 111
apf(6006): {blk_ports} deny all to/from udp port 111
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 513
apf(6006): {blk_ports} deny all to/from udp port 513
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 520
apf(6006): {blk_ports} deny all to/from udp port 520
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 445
apf(6006): {blk_ports} deny all to/from udp port 445
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1433
apf(6006): {blk_ports} deny all to/from udp port 1433
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1434
apf(6006): {blk_ports} deny all to/from udp port 1434
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1234
apf(6006): {blk_ports} deny all to/from udp port 1234
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1524
apf(6006): {blk_ports} deny all to/from udp port 1524
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 3127
apf(6006): {blk_ports} deny all to/from udp port 3127
apf(6006): {pkt_sanity} set active PKT_SANITY
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL NONE
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs SYN,FIN SYN,FIN
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs SYN,RST SYN,RST
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs FIN,RST FIN,RST
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ACK,FIN FIN
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ACK,URG URG
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ACK,PSH PSH
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL FIN,URG,PSH
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL SYN,RST,ACK,FIN,URG
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL ALL
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL FIN
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ALL NONE
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs SYN,FIN SYN,FIN
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs SYN,RST SYN,RST
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs FIN,RST FIN,RST
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ACK,FIN FIN
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ACK,PSH PSH
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ACK,URG URG
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `OUT_SANITY':/lib/iptables/libipt_OUT_SANITY.so: ca
nnot open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `IN_SANITY':/lib/iptables/libipt_IN_SANITY.so: cann
ot open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {pkt_sanity} deny all fragmented udp
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `FRAG_UDP':/lib/iptables/libipt_FRAG_UDP.so: cannot
open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `FRAG_UDP':/lib/iptables/libipt_FRAG_UDP.so: cannot
open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {pkt_sanity} deny inbound tcp port 0
apf(6006): {pkt_sanity} deny outbound tcp port 0
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `PZERO':/lib/iptables/libipt_PZERO.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `PZERO':/lib/iptables/libipt_PZERO.so: cannot open
shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {blk_p2p} set active BLK_P2P
iptables: Unknown error 4294967295
apf(6006): {blk_p2p} deny all to/from tcp port 1214
apf(6006): {blk_p2p} deny all to/from udp port 1214
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 2323
apf(6006): {blk_p2p} deny all to/from udp port 2323
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 4660:4678
apf(6006): {blk_p2p} deny all to/from udp port 4660:4678
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6257
apf(6006): {blk_p2p} deny all to/from udp port 6257
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6699
apf(6006): {blk_p2p} deny all to/from udp port 6699
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6346
apf(6006): {blk_p2p} deny all to/from udp port 6346
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6347
apf(6006): {blk_p2p} deny all to/from udp port 6347
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6881:6889
apf(6006): {blk_p2p} deny all to/from udp port 6881:6889
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6346
apf(6006): {blk_p2p} deny all to/from udp port 6346
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 7778
apf(6006): {blk_p2p} deny all to/from udp port 7778
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `P2P':/lib/iptables/libipt_P2P.so: cannot open shar
ed object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `P2P':/lib/iptables/libipt_P2P.so: cannot open shar
ed object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {glob} loading log.rules
apf(6006): {glob} virtual net subsystem disabled.
apf(6006): {glob} loading main.rules
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 22 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 53 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 110 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 143 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 7777 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 7778 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 7779 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 3000:3500 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 43 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 7777 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 7778 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 7779 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound udp port 20 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 3 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 5 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 11 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 0 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 30 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 8 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound icmp all on 0/0
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} resolv dns discovery for 209.130.152.7
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} resolv dns discovery for 209.130.152.8
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} loading postroute.rules
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} default (egress) output drop
apf(6006): {glob} default (ingress) input drop
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(5966): {glob} firewall initalized
apf(5966): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.
-bash-3.1#
|
|
|
|
| Re: Firewall for LXAdmin [message #49961 is a reply to message #6329] |
Wed, 10 December 2008 14:38   |
|
I had the same error time ago in a VE. In fact,
iptables: Unknown error 4294967295
I solved by this way:
First i read and made, step by step the mentioned post:
http://kb.parallels.com/article_130_875_en.html
By any reason, the problem is in the --numiptent. I increase value to 1000, then:
# vzctl set VZ_ID --numiptent 1000 --save
Apf working perfectly now. Hope this help.
P.D. If you make a simple "dmesg" on node, probably you see the VE outtage resources.
Regards,
Amil,
Hostenlinea Networks
[Updated on: Wed, 10 December 2008 14:45] Report message to a moderator
|
|
|
| Re: Firewall for LXAdmin [message #49962 is a reply to message #49961] |
Wed, 10 December 2008 14:40   |
Lxhelp Messages: 23691 Registered: July 2006 |
The Champion |
|
|
Lxadmin sets numiptent as a function of number of processes . So if you set the number of processes as unlimited, it should work fine.
On Wed, Dec 10, 2008 at 07:38:35PM -0000, Amil wrote:
>
>
> I had the same error time ago in a VE. In fact,
> iptables: Unknown error 4294967295
> I solved by this way:
>
> First i read and made, step by step the mentioned post:
> http://kb.parallels.com/article_130_875_en.html
|
|
|
|
| Re: Firewall for LXAdmin [message #49967 is a reply to message #49966] |
Wed, 10 December 2008 14:50   |
Lxhelp Messages: 23691 Registered: July 2006 |
The Champion |
|
|
HyperVM will set the iptent as 999999, if the process is set to unlimited. If it doesn't, then it is a major bug.
thanks.
On Wed, Dec 10, 2008 at 07:46:29PM -0000, Amil wrote:
>
>
> Yeah Lxadmin, I have all unlimited on VPS, except memory and harddisk, but the only way to get working this, was adding directly this command to master node :)
|
|
|