APF on CentOS-5 OpenVZ Containers

Submitted by sandip on Tue, 06/24/2008 - 12:00

Increase the NUMIPTENT values in VE conf file to 1000 on the host:

NUMIPTENT="1000:1000"
Edit "/etc/sysconfig/vz" on the host:

IPTABLES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_owner ipt_length ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ipt_recent"
Make sure the above modules are loaded on the host, so it would help if you have APF on the host as well.
Restart the VE

# vzctl restart <VEID>
It is normal to get ipt_recent error as below:

Warning: Unknown iptable module: ipt_recent, skipped

You can verify the modules loaded via:

# vzctl exec <VEID> grep ipt_recent /proc/net/ip_tables_matches

Note: ipt_recent is required for passive ftp to work, else... will need to specify passive ftp ports in ftp conf file and open those ports via apf as well.
Here is a typical apf config on a VE with CentOS-5 running ISPConfig.
DEVEL_MODE="0" IFACE_IN="venet0" IFACE_OUT="venet0" IFACE_TRUSTED="" SET_MONOKERN="1" IG_TCP_CPORTS="21,22,25,53,80,81,110,143,443" IG_UDP_CPORTS="53" EGF="1" EG_TCP_CPORTS="21,25,80,443,43" EG_UDP_CPORTS="20,21,53"

Bookmark/Search this post with

See Also