search

tlhackque / BlockCountries

iptables manager for IP blocking by country
Other
32 stars 6 forks source link

Rules update failed #14

Closed borjaevo closed 7 years ago

borjaevo commented 7 years ago

I tried to run BlockCountries in a debian 7 server.

Starting blocked countries IP filter: Updated IP zone data from apnic Updated IP zone data from lacnic Updated IP zone data from afrinic Updated IP zone data from ripe Updated IP zone data from ariniptables-restore: line 11365 failed Rules update failed: exit code 1 at line 0 [FAILED]

Not sure if i done something wrong.

Thanks.

tlhackque commented 7 years ago

After considerable off-line analysis, we determined that the problem is an incomplete or corrupt version of iptables. Specifically, (at least) the limit and multiport modules are not present and can't be loaded - either by iptables, by iptables-restore, or by modprobe.

The system is using a kernel not from a standard Debian distribution nor built by you.

An empty lsmod tends to indicate that this is a VPS, which is not exporting the kernel module library nor loading these modules into the kernel.

Resolution will require you to contact the kernel (perhaps hosting) provider. Be aware that configuration changes and/or BlockCountries updates may require additional netfilter modules. The hosting provider of a VPS may not wish to load all possible modules. So this may be an on-going issue.

In any case, this is not a BlockCountries issue.

To make troubleshooting similar systems easier for future users, a test for this misconfiguration of iptables is in the next major release of bcinstall.

tlhackque commented 7 years ago

@borjaevo reports that after installing a standard Debian kernel, BlockCountries works as expected. This confirms the diagnosis.

The host is not a VPS (it is a leased dedicated server from a hosting provider), but it did use a custom kernel that included a subset of iptables that is not sufficient for BlockCountries and does not support loadable modules.

The delay was due to the time required to find a maintenance window for the kernel installation.

borjaevo commented 7 years ago

First of all i just want to thank Tim for helping me, it was a long journey and he help me even with some questions not directly related with BlockCountries, he has shown great knowledge and patience.

Like Tim said problem was minimal kernel i have installed before, i confirm after upgrading kernel BlockCountries work as expected. Its been used for some days now and works very well.