iptables doesn't start

behzadfu · 06-27-2009, 12:09 PM

Hello
I have a proble with iptables after flushing rules
now iptables doesnt start

-bash-3.2# service iptables start
iptables: Applying firewall rules: FATAL: Error inserting ip_tables (/lib/module
s/2.6.18-92.1.10.el5xen/kernel/net/ipv4/netfilter/ip_tables.ko): Operation not p
ermitted
iptables-restore v1.4.1.1: iptables-restore: unable to initialize table 'nat'

Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
what Can I do?
thanks

GrapefruiTgirl · 06-27-2009, 12:13 PM

let's start with something easy first:

I believe you need to be root to start/stop iptables, and if so, did you execute the command as root?

Sasha

behzadfu · 06-27-2009, 12:16 PM

yes I run as root
and I tried stop start
but no success

GrapefruiTgirl · 06-27-2009, 12:18 PM

Check that the iptables and/or firewall script you are running, and any sub-scripts that are called, all have Execute permissions?

behzadfu · 06-27-2009, 12:22 PM

I using iptables over 1 year on this server
this problem occored yesterday after the flushing iptables rules
I dont use another script or firewall

Uncle_Theodore · 06-27-2009, 12:25 PM

Try typing these two commands in a terminal:

lsmod | grep ip_tables
modprobe ip_tables

What output do you get?

vap16oct1984 · 06-27-2009, 12:26 PM

Yes u can do much more things to recover it. lets start with some basic steps

Well can u give us some error logs.
PLs run this command give us error logs
#dmesg |grep nat

well run this command
# /etc/init.d/iptables restart
give us output. if issue not resolved we will discuess it.

vap16oct1984 · 06-27-2009, 12:30 PM

yes u can do much more things to figure out this problem. Lets first start with some basic steps. Pls give us all the error logs.
# /etc/init.d/iptables restart

if error comes give us .
now use this command to send us logs
#dmesg |grep nat

and see what happen when u run
modprobe iptable_nat

behzadfu · 06-27-2009, 12:33 PM

-bash-3.2# lsmod | grep ip_tables
-bash-3.2# modprobe ip_tables
FATAL: Error inserting ip_tables (/lib/modules/2.6.18-92.1.10.el5xen/kernel/net/
ipv4/netfilter/ip_tables.ko): Operation not permitted

-bash-3.2#/etc/init.d/iptables restart
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
- signature keyid: 6a600ae9d3acc50f ver=3
-bash-3.2# /etc/init.d/iptables restart
iptables: Applying firewall rules: FATAL: Error inserting ip_tables (/lib/module
s/2.6.18-92.1.10.el5xen/kernel/net/ipv4/netfilter/ip_tables.ko): Operation not p
ermitted
iptables-restore v1.4.1.1: iptables-restore: unable to initialize table 'nat'

Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]

custangro · 06-27-2009, 12:34 PM

Quote:

Originally Posted by behzadfu

Hello
I have a proble with iptables after flushing rules
now iptables doesnt start

-bash-3.2# service iptables start
iptables: Applying firewall rules: FATAL: Error inserting ip_tables (/lib/module
s/2.6.18-92.1.10.el5xen/kernel/net/ipv4/netfilter/ip_tables.ko): Operation not p
ermitted
iptables-restore v1.4.1.1: iptables-restore: unable to initialize table 'nat'

Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
what Can I do?
thanks

What is in /etc/sysconfig/iptables? Also did you try the recomended iptables-restore -h command?

What distro are you using? Looks like a Red Hat distro....posting /etc/sysconfig/iptables would help

-C

behzadfu · 06-27-2009, 12:49 PM

I use centos 2.6.18-128.1.14.el5xen on a xen vps
this is content of /etc/sysconfig/iptables

Code:

# Generated by iptables-save v1.4.1.1 on Wed Mar  4 21:34:40 2009
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [2:110]
:OUTPUT ACCEPT [2:110]
-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE 
COMMIT
# Completed on Wed Mar  4 21:34:40 2009
# Generated by iptables-save v1.4.1.1 on Wed Mar  4 21:34:40 2009
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:INVALID - [0:0]
:INVDROP - [0:0]
:LOCALINPUT - [0:0]
:LOCALOUTPUT - [0:0]
:LOGDROPIN - [0:0]
:LOGDROPOUT - [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -s 85.234.144.209/32 -i ! lo -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT 
-A INPUT -s 85.234.144.209/32 -i ! lo -p tcp -m tcp --sport 1024:65535 --dport 53 -j ACCEPT 
-A INPUT -s 85.234.144.209/32 -i ! lo -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT 
-A INPUT -s 85.234.144.209/32 -i ! lo -p tcp -m tcp --sport 53 --dport 1024:65535 -j ACCEPT 
-A INPUT -s 85.234.144.209/32 -i ! lo -p udp -m udp --sport 53 --dport 53 -j ACCEPT 
-A INPUT -s 85.234.133.209/32 -i ! lo -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT 
-A INPUT -s 85.234.133.209/32 -i ! lo -p tcp -m tcp --sport 1024:65535 --dport 53 -j ACCEPT 
-A INPUT -s 85.234.133.209/32 -i ! lo -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT 
-A INPUT -s 85.234.133.209/32 -i ! lo -p tcp -m tcp --sport 53 --dport 1024:65535 -j ACCEPT 
-A INPUT -s 85.234.133.209/32 -i ! lo -p udp -m udp --sport 53 --dport 53 -j ACCEPT 
-A INPUT -i ! lo -j LOCALINPUT 
-A INPUT -i ! lo -p tcp -j INVALID 
-A INPUT -i ! lo -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 23 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 953 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 1723 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 7777 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 7778 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 24814 -j ACCEPT 
-A INPUT -i ! lo -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT 
-A INPUT -i ! lo -p udp -m state --state NEW -m udp --dport 20 -j ACCEPT 
-A INPUT -i ! lo -p udp -m state --state NEW -m udp --dport 21 -j ACCEPT 
-A INPUT -i ! lo -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
-A INPUT -i ! lo -p udp -m state --state NEW -m udp --dport 953 -j ACCEPT 
-A INPUT -i ! lo -p icmp -m limit --limit 8/sec -j ACCEPT 
-A INPUT -i ! lo -j LOGDROPIN 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -d 85.234.144.209/32 -o ! lo -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT 
-A OUTPUT -d 85.234.144.209/32 -o ! lo -p tcp -m tcp --sport 53 --dport 1024:65535 -j ACCEPT 
-A OUTPUT -d 85.234.144.209/32 -o ! lo -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT 
-A OUTPUT -d 85.234.144.209/32 -o ! lo -p tcp -m tcp --sport 1024:65535 --dport 53 -j ACCEPT 
-A OUTPUT -d 85.234.144.209/32 -o ! lo -p tcp -m tcp --sport 53 --dport 53 -j ACCEPT 
-A OUTPUT -d 85.234.133.209/32 -o ! lo -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT 
-A OUTPUT -d 85.234.133.209/32 -o ! lo -p tcp -m tcp --sport 53 --dport 1024:65535 -j ACCEPT 
-A OUTPUT -d 85.234.133.209/32 -o ! lo -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT 
-A OUTPUT -d 85.234.133.209/32 -o ! lo -p tcp -m tcp --sport 1024:65535 --dport 53 -j ACCEPT 
-A OUTPUT -d 85.234.133.209/32 -o ! lo -p tcp -m tcp --sport 53 --dport 53 -j ACCEPT 
-A OUTPUT -o ! lo -j LOCALOUTPUT 
-A OUTPUT -o ! lo -p tcp -j INVALID 
-A OUTPUT -o ! lo -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 113 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 953 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 1723 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT 
-A OUTPUT -o ! lo -p tcp -m state --state NEW -m tcp --dport 9999 -j ACCEPT 
-A OUTPUT -o ! lo -p udp -m state --state NEW -m udp --dport 20 -j ACCEPT 
-A OUTPUT -o ! lo -p udp -m state --state NEW -m udp --dport 21 -j ACCEPT 
-A OUTPUT -o ! lo -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
-A OUTPUT -o ! lo -p udp -m state --state NEW -m udp --dport 113 -j ACCEPT 
-A OUTPUT -o ! lo -p udp -m state --state NEW -m udp --dport 123 -j ACCEPT 
-A OUTPUT -o ! lo -p udp -m state --state NEW -m udp --dport 953 -j ACCEPT 
-A OUTPUT -o ! lo -p icmp -m limit --limit 8/sec -j ACCEPT 
-A OUTPUT -o ! lo -j LOGDROPOUT 
-A INVALID -m state --state INVALID -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,ACK FIN -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags PSH,ACK PSH -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags ACK,URG URG -j INVDROP 
-A INVALID -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j INVDROP 
-A INVDROP -j DROP 
-A LOCALINPUT -s 212.120.218.135/32 -i ! lo -j ACCEPT 
-A LOCALINPUT -s 80.191.211.5/32 -i ! lo -j ACCEPT 
-A LOCALINPUT -s 66.186.34.250/32 -i ! lo -j ACCEPT 
-A LOCALINPUT -s 217.219.140.89/32 -i ! lo -j ACCEPT 
-A LOCALINPUT -s 72.54.214.71/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 77.92.68.15/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 200.196.51.29/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 70.159.142.121/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 78.108.248.18/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 88.191.11.82/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 58.210.237.107/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 88.220.124.194/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 211.219.166.69/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 218.19.140.21/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 86.109.59.4/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 207.246.106.91/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 218.53.97.7/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 77.69.240.200/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 83.19.255.106/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 78.110.173.184/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 165.248.7.141/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 211.151.46.252/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 122.70.128.146/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 75.125.162.122/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 122.147.88.67/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 202.159.24.7/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 81.209.164.12/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 219.234.83.30/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 203.129.200.51/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 59.163.43.104/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 140.126.132.134/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 81.246.22.172/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 210.176.26.185/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 218.97.161.165/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 216.57.203.69/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 193.138.125.84/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 59.188.7.108/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 84.52.172.114/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 75.149.153.57/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 132.248.51.71/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 78.35.24.176/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 218.56.61.114/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 202.220.163.180/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 61.150.114.76/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 78.110.170.224/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 218.23.105.25/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 125.76.229.232/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 200.11.153.145/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 89.111.180.179/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 85.204.4.207/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 69.90.74.99/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 87.120.41.100/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 66.80.59.131/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 123.49.46.3/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 125.222.191.94/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 212.1.97.86/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 203.91.145.98/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 88.191.99.158/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 222.236.47.95/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 69.147.227.74/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 200.55.209.66/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 85.114.130.208/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 189.141.65.104/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 195.97.224.50/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 202.108.145.103/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 189.3.93.140/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 89.165.121.41/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 89.218.80.130/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 84.204.229.250/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 78.99.146.172/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 218.232.104.195/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 77.74.198.121/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 194.106.175.102/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 211.10.176.180/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 200.26.153.205/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 66.114.89.49/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 61.97.43.109/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 202.198.129.252/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 219.146.252.203/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 193.251.65.173/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 80.51.159.122/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 121.14.149.80/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 173.9.195.11/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 69.162.110.125/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 121.10.143.6/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 210.57.230.22/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 128.95.48.63/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 74.208.99.46/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 61.34.78.200/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 71.183.218.50/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 208.112.113.20/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 124.118.247.8/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 193.218.96.74/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 61.240.126.34/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 200.11.179.163/32 -i ! lo -j LOGDROPIN 
-A LOCALINPUT -s 193.227.4.92/32 -i ! lo -j LOGDROPIN 
-A LOCALOUTPUT -d 212.120.218.135/32 -o ! lo -j ACCEPT 
-A LOCALOUTPUT -d 80.191.211.5/32 -o ! lo -j ACCEPT 
-A LOCALOUTPUT -d 66.186.34.250/32 -o ! lo -j ACCEPT 
-A LOCALOUTPUT -d 217.219.140.89/32 -o ! lo -j ACCEPT 
-A LOCALOUTPUT -d 72.54.214.71/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 77.92.68.15/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 200.196.51.29/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 70.159.142.121/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 78.108.248.18/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 88.191.11.82/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 58.210.237.107/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 88.220.124.194/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 211.219.166.69/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 218.19.140.21/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 86.109.59.4/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 207.246.106.91/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 218.53.97.7/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 77.69.240.200/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 83.19.255.106/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 78.110.173.184/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 165.248.7.141/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 211.151.46.252/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 122.70.128.146/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 75.125.162.122/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 122.147.88.67/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 202.159.24.7/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 81.209.164.12/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 219.234.83.30/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 203.129.200.51/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 59.163.43.104/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 140.126.132.134/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 81.246.22.172/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 210.176.26.185/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 218.97.161.165/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 216.57.203.69/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 193.138.125.84/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 59.188.7.108/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 84.52.172.114/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 75.149.153.57/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 132.248.51.71/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 78.35.24.176/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 218.56.61.114/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 202.220.163.180/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 61.150.114.76/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 78.110.170.224/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 218.23.105.25/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 125.76.229.232/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 200.11.153.145/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 89.111.180.179/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 85.204.4.207/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 69.90.74.99/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 87.120.41.100/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 66.80.59.131/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 123.49.46.3/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 125.222.191.94/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 212.1.97.86/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 203.91.145.98/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 88.191.99.158/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 222.236.47.95/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 69.147.227.74/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 200.55.209.66/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 85.114.130.208/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 189.141.65.104/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 195.97.224.50/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 202.108.145.103/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 189.3.93.140/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 89.165.121.41/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 89.218.80.130/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 84.204.229.250/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 78.99.146.172/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 218.232.104.195/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 77.74.198.121/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 194.106.175.102/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 211.10.176.180/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 200.26.153.205/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 66.114.89.49/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 61.97.43.109/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 202.198.129.252/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 219.146.252.203/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 193.251.65.173/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 80.51.159.122/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 121.14.149.80/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 173.9.195.11/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 69.162.110.125/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 121.10.143.6/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 210.57.230.22/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 128.95.48.63/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 74.208.99.46/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 61.34.78.200/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 71.183.218.50/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 208.112.113.20/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 124.118.247.8/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 193.218.96.74/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 61.240.126.34/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 200.11.179.163/32 -o ! lo -j LOGDROPOUT 
-A LOCALOUTPUT -d 193.227.4.92/32 -o ! lo -j LOGDROPOUT 
-A LOGDROPIN -p tcp -m tcp --dport 67 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 67 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 68 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 68 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 111 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 111 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 113 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 113 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 135:139 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 135:139 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 445 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 445 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 513 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 513 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 520 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 520 -j DROP 
-A LOGDROPIN -p tcp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_IN Blocked* " 
-A LOGDROPIN -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_IN Blocked* " 
-A LOGDROPIN -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_IN Blocked* " 
-A LOGDROPIN -j DROP 
-A LOGDROPOUT -p tcp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_OUT Blocked* " 
-A LOGDROPOUT -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_OUT Blocked* " 
-A LOGDROPOUT -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_OUT Blocked* " 
-A LOGDROPOUT -j DROP 
COMMIT
# Completed on Wed Mar  4 21:34:40 2009
# Generated by iptables-save v1.4.1.1 on Wed Mar  4 21:34:40 2009
*mangle
:PREROUTING ACCEPT [102:9703]
:INPUT ACCEPT [102:9703]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [126:11167]
:POSTROUTING ACCEPT [126:11167]
COMMIT
# Completed on Wed Mar  4 21:34:40 2009

Uncle_Theodore · 06-27-2009, 12:56 PM

Well, the problem seems to be with your ability to insert modules (or just one particular module). Could you run

whoami
ls -l /sbin/modprobe
depmod -a

and then
modprobe ip_tables
again? Sorry, the first two are just to remove the obvious (I remember, you said you were root, but just in case...)

behzadfu · 06-27-2009, 01:04 PM

thanks for your help

Code:

-bash-3.2# whoami
root
-bash-3.2# ls -l /sbin/modprobe
-rwxr-xr-x 1 root root 85020 Jan 21 09:34 /sbin/modprobe
-bash-3.2# depmod -a
-bash-3.2# modprobe ip_tables
FATAL: Error inserting ip_tables (/lib/modules/2.6.18-128.1.14.el5xen/kernel/net
/ipv4/netfilter/ip_tables.ko): Operation not permitted

GrapefruiTgirl · 06-27-2009, 01:08 PM

The modprobe command might be aliased to something else, like a script.

Try this:

/sbin/modprobe ip_tables

Any difference?

PS - I am not versed in XEN at all, but could the environment (the VM) be a source of the problem?

GrapefruiTgirl · 06-27-2009, 01:11 PM

I am seeing two different kernel releases in the [code] tags above.

It's looking like.. Well, I don't know, need more information here. It looks like we're trying to modprobe modules for another kernel.