1

I've been browsing and reading documentations all night and I can't figure out any solution...

I'm trying to get iptables working on my VPS (Debian 7).

But I can't get established connections answered. The "-m state --state" and also "-m conntrack --ctstate" both don't work. Both result in iptables: No chain/target/match by that name.

As far as I figured out, state has been outsourced from iptables and conntrack isn't installed on my system and isn't possible to be installed because I ain't got Kernel-Access to the network interfaces system. I tried to install it from scratch but both tries (from packages and from source) failed. I changed the system to Ubuntu 14.04 for try but it didn't work either.

Is there any workaround or anything else I can do? I'm regulary using PF with OpenBSD as Firewall, so I'm not very familiar with iptables.

Here are the rules I'm adding - have I maybe forgotten something?

iptalbes -F
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j DROP
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

All rules beside the mentioned one are working well!

I found this question asked here before but there were no helpful answers or solutions.

I'm thankful for any help in advance :)

Velvetto Warrioror
  • 11
  • 2

1 Answers1

0

Is kernel module nf_conntrack exist at /lib/modules//kernel/net/netfilter/ and loaded? If exist try:

modprobe nf_conntrack
Maxiko
  • 474
  • 2
  • 8
  • Nope, doesn't exist. Conntrack doesn't seem to be an option here. – Velvetto Warrioror May 12 '15 at 10:22
  • Are you running on OpenVZ? If yes, try to install linux-image deb packet same version as your running kernel and then try to load module, if it doesn't help then you should contact your provider to enable iptables. – Maxiko May 12 '15 at 10:26
  • Hey Maxiko, sadly I'm not running on OpenVZ. This would've made it much easier.... Provider has been contacted but hasn't responded yet... – Velvetto Warrioror May 12 '15 at 10:31
  • Anyway, try to install linux-image deb packet same version as your running kernel. – Maxiko May 13 '15 at 02:48
  • I did so, conntrack and state still not working. Should I try installing conntrack by hand now again or isn't it worth the try? – Velvetto Warrioror May 13 '15 at 17:14