CentOS: How to install, enable xt_connlimit iptables module on OpenVZ server?

**Fli** · 05-27-2014, 08:47 AM

Hello, please can anyone help how to install, enable xt_connlimit iptables module on OpenVZ server with CentOS 6?

Testing xt_connlimit...FAILED [Error: iptables: Invalid argument. Run `dmesg' for more information.] - Required for CONNLIMIT feature

dmesg:

ip_tables: connlimit match: invalid size 24 != 32

CentOS 6 and newer, i think module can be enabled by doing commands on the host node server where VPS (guest) is hosted:
modprobe xt_connlimit
modprobe ipt_connlimit

Then making sure netfilter is enabled on the VPS (full/statefull) in:
cat /etc/vz/conf/CTIDHERE.conf|grep NETFILTER

If not, read "man vzctl" and find NETFILTER explanation

Connlimit do not work on CentOS 5 and older/explained: https://lists.centos.org/pipermail/centos/2008-June/059656.html

CentOS release 6.8 (Final) - worked ..OK

CentOS release 5.9 (Final) - iptables: Unknown error 18446744073709551615] - Required for CONNLIMIT feature

In case of CentOS version 5.x, Check advice here: https://kb.plesk.com/en/115411
The resolution is: "While setting connlimit rules, make sure to specify that --connlimit-mask 32 should work around the bug until it is fixed in CentOS."

But even without that i see this on Centos 5 when listing iptables (iptables -l INPUT):

tcp -- anywhere anywhere tcp dpt:http state NEW recent: SET name: 80 side: source
PORTFLOOD tcp -- anywhere anywhere tcp dpt:http state NEW recent: UPDATE seconds: 5 hit_count: 20 name: 80 side: source