LxCenter HyperVM & Kloxo Support

Forum



Members   Search      Help    Register    Login    Home
Home » Kloxo Community Support » Knowledge Base » Firewall for LXAdmin
Firewall for LXAdmin [message #6329] Sat, 09 June 2007 19:17 Go to next message
Galaxy Hosts is currently offline Galaxy Hosts  United States
Messages: 18
Registered: June 2007
Member
Hello I am curious what firewall you recommend using with LXAdmin. I am familiar with securing cpanel and directadmin, but lxadmin is new to me. I am guessing APF would work good with LXAdmin. Do you have any other suggestions? What ports need to be left open in lxadmin? Do you know of a good tutorial?

Thanks for your help.
Re: Firewall for LXAdmin [message #6341 is a reply to message #6329] Sat, 09 June 2007 21:23 Go to previous messageGo to next message
Lxhelp
Messages: 23691
Registered: July 2006
The Champion
Quote:


>
>
> Hello I am curious what firewall you recommend using with LXAdmin. I am familiar with securing cpanel and directadmin, but lxadmin is new to me. I am guessing APF would work good with LXAdmin. Do you have any other suggestions? What ports need to be left open in lxadmin? Do you know of a good tutorial?
>
> Thanks for your help.



APF seems to be the most commonly used one, and it should work fine with lxadmin. You need to have 7777/7778 ports for web access and 7779 for internal and external communication. Opening these ports should be enough.

There are no tutorials for firewall and lxadmin available at this point, but we will have some guidelines for securing Lxadmin, and will also include some of it into the CP itself.


Thanks.


Re: Firewall for LXAdmin [message #6417 is a reply to message #6329] Mon, 11 June 2007 05:40 Go to previous messageGo to next message
Galaxy Hosts is currently offline Galaxy Hosts  United States
Messages: 18
Registered: June 2007
Member
This may help, I have modified a tutorial for apf so it will work for LXAdmin. If you see any changes that need to be made let me know.
Important: Be sure Iptables were enabled when the VM was created (openvz)


1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.6-2/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.6-2: Completed.

Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/

Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,7776,7777,7778, 7779,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

6. Lets configure the firewall: pico /etc/apf/conf.apf (or nano /etc/apf/conf.apf)
We will go over the general configuration to get your firewall running. This isn't a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

We like to use DShield.org's "block" list of top networks that have exhibited
suspicious activity.
FIND: USE_DS="0"
CHANGE TO: USE_DS="1"

Find the following lines:
IFACE_IN="eth0"
IFACE_OUT="eth0"
and change them to
IFACE_IN="venet0"
IFACE_OUT="venet0"

7. Configuring Firewall Ports:

LxAdmin Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,7777,7778,7779,3000_3500 "
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43,7777,7778,7779"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

Save the changes: Ctrl+X then Y


8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|--start ......................... load firewall policies
-r|--restart ....................... flush & load firewall
-f|--flush|--stop .................. flush firewall
-l|--list .......................... list chain rules
-st|--status ....................... firewall status
-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall


9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM="1"
CHANGE TO: DEVM="0"

10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

pico /etc/apf/ad/conf.antidos

There are various things you might want to fiddle with but I'll get the ones that will alert you by email.

# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME="Your Company"
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT="0"
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR="your@email.com"
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log

Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123


12. New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:

chkconfig --level 2345 apf on

To remove it from autostart, run this:

chkconfig --del apf


13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I'll show you 2 of the easier methods.

A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -d 185.14.157.123 TESTING

pico /etc/apf/deny_hosts.rules

Shows the following:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules

You can then just add a new line and enter the IP you wish to block. Before this becomes active though you'll need to reload the APF ruleset.

/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)

I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

/etc/apf/apf -r

B) If the IP isn't already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123

[Updated on: Mon, 11 June 2007 05:48]

Report message to a moderator

Re: Firewall for LXAdmin [message #6419 is a reply to message #6329] Mon, 11 June 2007 05:53 Go to previous messageGo to next message
Galaxy Hosts is currently offline Galaxy Hosts  United States
Messages: 18
Registered: June 2007
Member
Now I am trying to install this on a VM that does not have Iptables enabled and it will not let me simply chech the box in hyper vm to enable it. I would rather not delete and remake the VM if I cab help it. Any suggestions?
Re: Firewall for LXAdmin [message #6420 is a reply to message #6419] Mon, 11 June 2007 05:56 Go to previous messageGo to next message
Lxhelp
Messages: 23691
Registered: July 2006
The Champion
Quote:


>
>
> Now I am trying to install this on a VM that does not have Iptables enabled and it will not let me simply chech the box in hyper vm to enable it. I would rather not delete and remake the VM if I cab help it. Any suggestions?



That means that the client who is owning the vm doesn't have the specified permission. So go the client home -> limit and enable it first.

Thanks.


Re: Firewall for LXAdmin [message #6421 is a reply to message #6420] Mon, 11 June 2007 06:16 Go to previous messageGo to next message
Galaxy Hosts is currently offline Galaxy Hosts  United States
Messages: 18
Registered: June 2007
Member
That worked, thank you very much.
Re: Firewall for LXAdmin [message #7566 is a reply to message #6329] Thu, 28 June 2007 22:26 Go to previous messageGo to next message
lanx is currently offline lanx  United States
Messages: 21
Registered: June 2007
Location: localhost
Member
Hi, Iv been getting ddosed lately and i dont know how to stop it. Can you guys please tell me how i can stop this mass ddos attack on my site.
  • Attachment: 1.txt
    (Size: 66.79KB, Downloaded 410 times)
Re: Firewall for LXAdmin [message #9381 is a reply to message #6329] Thu, 26 July 2007 07:30 Go to previous messageGo to next message
alja is currently offline alja  Austria
Messages: 192
Registered: July 2007
Senior Member
Hi, I have followed all the steps but now I cannot access the Lxadmin service. I have added the ports as stated in the how to but I don't know what I'm doing wrong.

Thanks.

Edit> I can login using only the https and port 7777

[Updated on: Thu, 26 July 2007 07:32]

Report message to a moderator

Re: Firewall for LXAdmin [message #9640 is a reply to message #9381] Mon, 30 July 2007 05:04 Go to previous messageGo to next message
ankwebsolutions.com is currently offline ankwebsolutions.com  Australia
Messages: 18
Registered: July 2007
Location: Australia
Member
alja wrote on Thu, 26 July 2007 07:30

Hi, I have followed all the steps but now I cannot access the Lxadmin service. I have added the ports as stated in the how to but I don't know what I'm doing wrong.

Thanks.

Edit> I can login using only the https and port 7777


This is because APF has a separate section for blocking P2P
ports, and 7778 is in this list.

Find it in conf.apf and remove the 7778 and then restart APF.
Re: Firewall for LXAdmin [message #9646 is a reply to message #9640] Mon, 30 July 2007 06:22 Go to previous messageGo to next message
alja is currently offline alja  Austria
Messages: 192
Registered: July 2007
Senior Member
Thanks! that was the problem I just looked for "BLK_P2P_PORTS" and removed the 7778 port.

Smile
Re: Firewall for LXAdmin [message #9647 is a reply to message #9646] Mon, 30 July 2007 06:23 Go to previous messageGo to next message
ankwebsolutions.com is currently offline ankwebsolutions.com  Australia
Messages: 18
Registered: July 2007
Location: Australia
Member
No problem!
I'm glad it worked Smile
Re: Firewall for LXAdmin [message #16625 is a reply to message #6329] Sun, 11 November 2007 06:12 Go to previous messageGo to next message
crankshaft is currently offline crankshaft  Singapore
Messages: 145
Registered: November 2007
Valuable Member
Hi;

Thanks for the guide, I have setup & configured as per your guide, I have also removed port 7778 from P2P, however when I try and startup I get the following error:

Starting APF:apf(16231): {glob} activating firewall
apf(16273): {glob} unable to load iptables module (ip_tables), aborting.
apf(16231): {glob} firewall initalized
apf(16231): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.


If I SET_MONOKERN="1" (to overcome the unable to load iptables module (ip_tables), aborting), it starts up but blocks all ports for 5 minutes until it shuts down (in development mode)

Any ideas ??

[Updated on: Sun, 11 November 2007 07:06]

Report message to a moderator

Re: Firewall for LXAdmin [message #16629 is a reply to message #16625] Sun, 11 November 2007 12:29 Go to previous messageGo to next message
Galaxy Hosts is currently offline Galaxy Hosts  United States
Messages: 18
Registered: June 2007
Member
Make sure that IPtables are enabled on your VPS. If you are using OpenVZ, you must check a box to enable IPtables when creating the VPS from HyperVM.
Re: Firewall for LXAdmin [message #16662 is a reply to message #6329] Sun, 11 November 2007 21:42 Go to previous messageGo to next message
crankshaft is currently offline crankshaft  Singapore
Messages: 145
Registered: November 2007
Valuable Member
Ahh, solved it, my error.

I had the following:

IG_TCP_CPORTS="21,22,25,53,80,443,110,143,7777,7778,7779,3000_3500"
IG_UDP_CPORTS="53"
IG_ICMP_TYPES="3,5,11,0,30,8"

# Common inbound (ingress) TCP ports
IG_TCP_CPORTS="22"

# Common inbound (ingress) UDP ports
IG_UDP_CPORTS=""


Which meant that the second occurence of IG_XXX_CPORTS over-wrote the first, i.e. only port 22 was opened !

Thanks
Re: Firewall for LXAdmin [message #16947 is a reply to message #6329] Tue, 20 November 2007 12:43 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

Hello a nubbie to vps here,

I am going to make myself sound stupid, but could someone please advise me where I would upload the files for apf?

Would I be right in assuming I should rename the unzipped file to apf and upload it into my etc folder?

And how I access the ./install.sh Is this via the hyper vm console access or command centre ?

Or am I totally off track, I can pretty much follow the above guide if my few questions are answered.

Suppose we all have to start somewhere lol. Embarassed
Re: Firewall for LXAdmin [message #16949 is a reply to message #16947] Tue, 20 November 2007 13:36 Go to previous messageGo to next message
LxCenter_Danny is currently offline LxCenter_Danny  Netherlands
Messages: 2068
Registered: July 2007
Location: Netherlands
Grandmaster
LxCenter Core Team Member
LxCenter Representative

You doing that as root in your shell console. (for windows users use putty or simular ssh tools)



LxCenter - System Operations

[Updated on: Tue, 20 November 2007 13:37]

Report message to a moderator

Re: Firewall for LXAdmin [message #16951 is a reply to message #16949] Tue, 20 November 2007 15:57 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

Thanks for your reply,

So I need to upload the files to Virtual Machine myname.vm/ / root
??
Re: Firewall for LXAdmin [message #16952 is a reply to message #6329] Tue, 20 November 2007 16:51 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

aha I've uploaded the files to root/apf
but when i try to run the ./install.sh

i get permission denied even when i change the permissions for apf directory?
Re: Firewall for LXAdmin [message #16953 is a reply to message #6329] Tue, 20 November 2007 17:15 Go to previous messageGo to next message
alja is currently offline alja  Austria
Messages: 192
Registered: July 2007
Senior Member
The key is at the begining of the thread

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.6-2/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed


just check the folder where you are at "pwd" make sure you tar the file you uploaded and then change the folder to run the script. If you are logged as root you should not have a problem.
Re: Firewall for LXAdmin [message #16959 is a reply to message #16953] Wed, 21 November 2007 09:25 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

Thanks I was misreading the instructions. with your help and my host adding some missing files it is now ready to use Smile
icon14.gif  Re: Firewall for LXAdmin [message #16960 is a reply to message #16959] Wed, 21 November 2007 09:31 Go to previous messageGo to next message
alja is currently offline alja  Austria
Messages: 192
Registered: July 2007
Senior Member
I´m glad you worked it out.
Re: Firewall for LXAdmin [message #30966 is a reply to message #6329] Tue, 27 May 2008 13:33 Go to previous messageGo to next message
ron.hower is currently offline ron.hower  Iran, Islamic Republic of
Messages: 77
Registered: May 2008
Valuable Member
i understand about this

please Put Complete Installation document and configuration for APF

thank Sad
Re: Firewall for LXAdmin [message #31424 is a reply to message #6329] Thu, 05 June 2008 18:24 Go to previous messageGo to next message
pace is currently offline pace  United States
Messages: 248
Registered: May 2008
Senior Member
I came across this document on how to configure openvz for iptables that will make the AFP work. Quite helpful:

http://kb.parallels.com/article_130_875_en.html


Cheers,
pace
Re: Firewall for LXAdmin [message #31427 is a reply to message #6329] Thu, 05 June 2008 21:16 Go to previous messageGo to next message
pace is currently offline pace  United States
Messages: 248
Registered: May 2008
Senior Member
Oh yeah, and unless you want people to get to your mysql server on port 3306 it is best to move the pure-ftpd's passive ports to something other than 3000-3500 so you can include its port range in the IG_TCP_CPORTS area.


pace
Re: Firewall for LXAdmin [message #31586 is a reply to message #6329] Wed, 11 June 2008 17:29 Go to previous messageGo to next message
xorock is currently offline xorock  Poland
Messages: 54
Registered: September 2007
Valuable Member
Hi. What port need to be open to connect to license server? I'm getting message "could not connect to..." when apf is running.
Re: Firewall for LXAdmin [message #31595 is a reply to message #31586] Thu, 12 June 2008 01:35 Go to previous messageGo to next message
Marie is currently offline Marie  France
Messages: 511
Registered: June 2007
Location: France
Master

xorock wrote on Wed, 11 June 2008 23:29

Hi. What port need to be open to connect to license server? I'm getting message "could not connect to..." when apf is running.


You have to open 5555 Smile


Marie
Need Further Assistance ? Here you go !
English, french and spanish support Smile
Re: Firewall for LXAdmin [message #32511 is a reply to message #6329] Tue, 01 July 2008 03:59 Go to previous messageGo to next message
metthyn is currently offline metthyn  Turkey
Messages: 10
Registered: June 2007
Member
i have installed apf-0.9.6-3 but i cant find /etc/apf/ad/conf.antidos

did they remove this feature?
Re: Firewall for LXAdmin [message #32962 is a reply to message #32511] Thu, 10 July 2008 02:34 Go to previous messageGo to next message
techfiz is currently offline techfiz  India
Messages: 14
Registered: March 2006
Location: India
Member


You can find it inside /etc/apf/ad




Regards,
TechFiz :::eXcluding eRrors:::
Blog: http://platonic.techfiz.info
Re: Firewall for LXAdmin [message #32970 is a reply to message #6329] Thu, 10 July 2008 09:39 Go to previous messageGo to next message
nimbar is currently offline nimbar  Spain
Messages: 4
Registered: July 2008
Location: Gijón, Spain
Member
CSF+LFD AND LXADMIN

Dear friends,

This is a tutorial to install ConfigServer Security and Firewall which is one of the most robust an free firewall softwares out there. It was designed for cPanel servers, but you can use it with your lxadmin system. Here we go:

1.- Follow the instructions provided here

2.- Once the firewall is installed, enter your server with your favourite SSH client: Putty, XShell or even WinSCP.

3.- Go to /etc/csf and edit csf.conf. Don't forget to open the ports 7777, 7778, 7779 and 5555. Configure the rest at your desires.

4.- Have PT_USERKILL = "1" enabled means the firewall will check for suspicious processes and will kill them. You would need to add an exception for lxadmin interface, mysql, tinydns, qmail and clamav, otherwise the processes will be killed and you will be very upset trying to figure out why lxadmin stops from time to time without any aparent reason.

5.- Ok, then go to csf.pignore and add:

user:lxlabs
user:clamav
user:mysql
user:tinydns
user:qmails
user:qmaill
user:qmailq
user:qmailr
(empty line here)


6.- Restart services by doing
service csf restart
service lfd restart


All done! Very Happy

Greetings from Gijón and thanks Marie!.


Nimbar - Ayuda en español
Need Further Assistance ? Here you go ! ! Smile

[Updated on: Mon, 14 July 2008 08:27]

Report message to a moderator

Re: Firewall for LXAdmin [message #33510 is a reply to message #6329] Sun, 20 July 2008 21:29 Go to previous messageGo to next message
risuku13 is currently offline risuku13  Philippines
Messages: 1
Registered: July 2008
Member
Hello! I followed the instructions above for installing CSF (nimbar’s post), I also opened ports 21, 80, 7777, etc.

and I used these as references:

http://forum.lxlabs.com/index.php?t=msg&goto=32970&
http://lxwiki.cwdev.co.uk/index.php/CSF_Firewall

My problem is, whenever I enable CSF, I can’t access my site’s HTTP and FTP. I’m running Cent OS 5 with Lxadmin.

TIA.

Smile
Re: Firewall for LXAdmin [message #33541 is a reply to message #6329] Mon, 21 July 2008 17:50 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

Hi Ive just installed apf 0.9.6-3 on my server

ip_tables is enabled when i check the service listing green light shows.

but when I start apf in devel mode I get the following message

 error fetching interface information: Device not found
apf(23657): {glob} activating firewall
0: error fetching interface information: Device not found
0: error fetching interface information: Device not found
apf(23703): {glob} unable to load iptables module (ip_tables), aborting.
apf(23657): {glob} firewall initalized
apf(23657): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.
-bash-3.1#


Wonder if anyone has any suggestions as to where Im going wrong?

Also both of below do not seem to be there when I goto edit the conf.antidos

AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos

any assistance is appreciated Razz
Re: Firewall for LXAdmin [message #33557 is a reply to message #6329] Tue, 22 July 2008 02:41 Go to previous messageGo to next message
evolnick is currently offline evolnick  Netherlands
Messages: 19
Registered: July 2008
Member
did you set the IFACE_IN and IFACE_OUT to "venet0"?

and i think antidos has been removed: "scrub of APF to remove all ties to antidos, the antidos subsystem has been removed and will be replaced with expanded RAB features".
see http://rfxnetworks.com/appdocs/CHANGELOG.apf
Re: Firewall for LXAdmin [message #33565 is a reply to message #33557] Tue, 22 July 2008 06:45 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

evolnick wrote on Tue, 22 July 2008 02:41

did you set the IFACE_IN and IFACE_OUT to "venet0"?

and i think antidos has been removed: "scrub of APF to remove all ties to antidos, the antidos subsystem has been removed and will be replaced with expanded RAB features".
see http://rfxnetworks.com/appdocs/CHANGELOG.apf



Hi

thanks for your reply. I had not set the IFACE_IN AND IFACE_OUT TO "venet".

I have now but I am still having a problem

apf(25680): {glob} activating firewall
apf(25722): {glob} unable to load iptables module (ip_tables), aborting.
apf(25680): {glob} firewall initalized
apf(25680): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.


Is there anything else I could be missing?
Re: Firewall for LXAdmin [message #33568 is a reply to message #6329] Tue, 22 July 2008 09:14 Go to previous messageGo to next message
evolnick is currently offline evolnick  Netherlands
Messages: 19
Registered: July 2008
Member
try to set SET_MONOKERN to "1" ( in /etc/apf/apf.conf )

tip: if you search this in google, you could have seen it too ( example search for 'apf ip_tables' )

[Updated on: Tue, 22 July 2008 09:15]

Report message to a moderator

Re: Firewall for LXAdmin [message #33572 is a reply to message #33568] Tue, 22 July 2008 10:13 Go to previous messageGo to next message
littlespelk is currently offline littlespelk  United Kingdom
Messages: 21
Registered: November 2007
Location: UK
Member

evolnick wrote on Tue, 22 July 2008 09:14

try to set SET_MONOKERN to "1" ( in /etc/apf/apf.conf )

tip: if you search this in google, you could have seen it too ( example search for 'apf ip_tables' )


Thanks but I already tried that after reading other posts on this forum and I got the following

apf(5966): {glob} activating firewall
apf(6006): {glob} determined (IFACE_IN) venet0 has address 127.0.0.1
apf(6006): {glob} determined (IFACE_OUT) venet0 has address 127.0.0.1
apf(6006): {glob} loading preroute.rules
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {resnet} downloading http://r-fx.ca/downloads/reserved.networks
apf(6006): {resnet} parsing reserved.networks into /etc/apf/internals/reserved.networks
apf(6006): {glob} loading reserved.networks
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables v1.3.5: Couldn't load target `TALLOW':/lib/iptables/libipt_TALLOW.so: cannot ope
n shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TALLOW':/lib/iptables/libipt_TALLOW.so: cannot ope
n shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TDENY':/lib/iptables/libipt_TDENY.so: cannot open
shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TDENY':/lib/iptables/libipt_TDENY.so: cannot open
shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGALLOW':/lib/iptables/libipt_TGALLOW.so: cannot o
pen shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGALLOW':/lib/iptables/libipt_TGALLOW.so: cannot o
pen shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGDENY':/lib/iptables/libipt_TGDENY.so: cannot ope
n shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `TGDENY':/lib/iptables/libipt_TGDENY.so: cannot ope
n shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {glob} SET_REFRESH is set to 10 minutes
apf(6006): {glob} loading bt.rules
apf(6006): {dshield} downloading http://feeds.dshield.org/top10-2.txt
apf(6006): {dshield} parsing top10-2.txt into /etc/apf/ds_hosts.rules
apf(6006): {dshield} loading ds_hosts.rules
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `DSHIELD':/lib/iptables/libipt_DSHIELD.so: cannot o
pen shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `DSHIELD':/lib/iptables/libipt_DSHIELD.so: cannot o
pen shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {sdrop} downloading http://www.spamhaus.org/drop/drop.lasso
apf(6006): {sdrop} parsing drop.lasso into /etc/apf/sdrop_hosts.rules
apf(6006): {sdrop} loading sdrop_hosts.rules
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `SDROP':/lib/iptables/libipt_SDROP.so: cannot open
shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `SDROP':/lib/iptables/libipt_SDROP.so: cannot open
shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {glob} loading common drop ports
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 135:139
apf(6006): {blk_ports} deny all to/from udp port 135:139
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 111
apf(6006): {blk_ports} deny all to/from udp port 111
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 513
apf(6006): {blk_ports} deny all to/from udp port 513
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 520
apf(6006): {blk_ports} deny all to/from udp port 520
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 445
apf(6006): {blk_ports} deny all to/from udp port 445
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1433
apf(6006): {blk_ports} deny all to/from udp port 1433
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1434
apf(6006): {blk_ports} deny all to/from udp port 1434
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1234
apf(6006): {blk_ports} deny all to/from udp port 1234
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 1524
apf(6006): {blk_ports} deny all to/from udp port 1524
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {blk_ports} deny all to/from tcp port 3127
apf(6006): {blk_ports} deny all to/from udp port 3127
apf(6006): {pkt_sanity} set active PKT_SANITY
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL NONE
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs SYN,FIN SYN,FIN
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs SYN,RST SYN,RST
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs FIN,RST FIN,RST
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ACK,FIN FIN
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ACK,URG URG
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ACK,PSH PSH
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL FIN,URG,PSH
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL SYN,RST,ACK,FIN,URG
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL ALL
apf(6006): {pkt_sanity} deny inbound tcp-flag pairs ALL FIN
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ALL NONE
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs SYN,FIN SYN,FIN
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs SYN,RST SYN,RST
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs FIN,RST FIN,RST
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ACK,FIN FIN
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ACK,PSH PSH
apf(6006): {pkt_sanity} deny outbound tcp-flag pairs ACK,URG URG
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `OUT_SANITY':/lib/iptables/libipt_OUT_SANITY.so: ca
nnot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `IN_SANITY':/lib/iptables/libipt_IN_SANITY.so: cann
ot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {pkt_sanity} deny all fragmented udp
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `FRAG_UDP':/lib/iptables/libipt_FRAG_UDP.so: cannot
 open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `FRAG_UDP':/lib/iptables/libipt_FRAG_UDP.so: cannot
 open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {pkt_sanity} deny inbound tcp port 0
apf(6006): {pkt_sanity} deny outbound tcp port 0
iptables: Unknown error 4294967295
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `PZERO':/lib/iptables/libipt_PZERO.so: cannot open
shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `PZERO':/lib/iptables/libipt_PZERO.so: cannot open
shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {blk_p2p} set active BLK_P2P
iptables: Unknown error 4294967295
apf(6006): {blk_p2p} deny all to/from tcp port 1214
apf(6006): {blk_p2p} deny all to/from udp port 1214
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 2323
apf(6006): {blk_p2p} deny all to/from udp port 2323
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 4660:4678
apf(6006): {blk_p2p} deny all to/from udp port 4660:4678
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6257
apf(6006): {blk_p2p} deny all to/from udp port 6257
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6699
apf(6006): {blk_p2p} deny all to/from udp port 6699
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6346
apf(6006): {blk_p2p} deny all to/from udp port 6346
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6347
apf(6006): {blk_p2p} deny all to/from udp port 6347
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6881:6889
apf(6006): {blk_p2p} deny all to/from udp port 6881:6889
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 6346
apf(6006): {blk_p2p} deny all to/from udp port 6346
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
apf(6006): {blk_p2p} deny all to/from tcp port 7778
apf(6006): {blk_p2p} deny all to/from udp port 7778
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.3.5: Couldn't load target `P2P':/lib/iptables/libipt_P2P.so: cannot open shar
ed object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load target `P2P':/lib/iptables/libipt_P2P.so: cannot open shar
ed object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
apf(6006): {glob} loading log.rules
apf(6006): {glob} virtual net subsystem disabled.
apf(6006): {glob} loading main.rules
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 22 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 53 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 110 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 143 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 7777 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 7778 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 7779 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound tcp port 3000:3500 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 43 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 7777 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 7778 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound tcp port 7779 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound udp port 20 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 3 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 5 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 11 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 0 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 30 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening inbound icmp type 8 on 0/0
iptables: Unknown error 4294967295
apf(6006): {glob} opening outbound icmp all on 0/0
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} resolv dns discovery for 209.130.152.7
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} resolv dns discovery for 209.130.152.8
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} loading postroute.rules
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(6006): {glob} default (egress) output drop
apf(6006): {glob} default (ingress) input drop
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
apf(5966): {glob} firewall initalized
apf(5966): {glob} !!DEVELOPMENT MODE ENABLED!! - firewall will flush every 5 minutes.
-bash-3.1#
Re: Firewall for LXAdmin [message #33648 is a reply to message #6329] Wed, 23 July 2008 03:10 Go to previous messageGo to next message
evolnick is currently offline evolnick  Netherlands
Messages: 19
Registered: July 2008
Member
I don't know this problem, but after searching it's all based on kernel problems.
What is your system configuration (os,kernel,..) and did you any recompile of the kernel,custom install of iptables,etc. You could also try a compleet system update.
Re: Firewall for LXAdmin [message #49961 is a reply to message #6329] Wed, 10 December 2008 14:38 Go to previous messageGo to next message
hostenlinea is currently offline hostenlinea  Spain
Messages: 123
Registered: August 2008
Valuable Member
I had the same error time ago in a VE. In fact,
iptables: Unknown error 4294967295
I solved by this way:

First i read and made, step by step the mentioned post:
http://kb.parallels.com/article_130_875_en.html

By any reason, the problem is in the --numiptent. I increase value to 1000, then:

# vzctl set VZ_ID --numiptent 1000 --save

Apf working perfectly now. Hope this help.

P.D. If you make a simple "dmesg" on node, probably you see the VE outtage resources.

Regards,


Amil,
Hostenlinea Networks

[Updated on: Wed, 10 December 2008 14:45]

Report message to a moderator

Re: Firewall for LXAdmin [message #49962 is a reply to message #49961] Wed, 10 December 2008 14:40 Go to previous messageGo to next message
Lxhelp
Messages: 23691
Registered: July 2006
The Champion
Lxadmin sets numiptent as a function of number of processes . So if you set the number of processes as unlimited, it should work fine.


On Wed, Dec 10, 2008 at 07:38:35PM -0000, Amil wrote:
>
>
> I had the same error time ago in a VE. In fact,
> iptables: Unknown error 4294967295
> I solved by this way:
>
> First i read and made, step by step the mentioned post:
> http://kb.parallels.com/article_130_875_en.html


Re: Firewall for LXAdmin [message #49966 is a reply to message #49962] Wed, 10 December 2008 14:46 Go to previous messageGo to next message
hostenlinea is currently offline hostenlinea  Spain
Messages: 123
Registered: August 2008
Valuable Member
Yeah Lxhelp, I have all unlimited on VPS, except memory and harddisk, but the only way to get working this, was adding directly this command to master node Smile

Thanks


Amil,
Hostenlinea Networks

[Updated on: Wed, 10 December 2008 14:47]

Report message to a moderator

Re: Firewall for LXAdmin [message #49967 is a reply to message #49966] Wed, 10 December 2008 14:50 Go to previous messageGo to previous message
Lxhelp
Messages: 23691
Registered: July 2006
The Champion
HyperVM will set the iptent as 999999, if the process is set to unlimited. If it doesn't, then it is a major bug.

thanks.


On Wed, Dec 10, 2008 at 07:46:29PM -0000, Amil wrote:
>
>
> Yeah Lxadmin, I have all unlimited on VPS, except memory and harddisk, but the only way to get working this, was adding directly this command to master node :)


Previous Topic:Place of log files
Next Topic:Re: Lighttp Rewrite Rule
Goto Forum:
  


Current Time: Sat May 25 00:43:15 EDT 2013

Total time taken to generate the page: 0.01838 seconds
.:: Contact :: Home :: Privacy ::.

Click here to lend your support to: LxCenter and make a donation at www.pledgie.com !

Powered by: FUDforum 3.0.2.
Copyright ©2001-2010 FUDforum Bulletin Board Software