Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ive got VPS running on an Open VZ virtualisation instance. Unfortunately im having a lot of trouble getting a firewall up and running. Ive tried my usual UFW and shorewall, but neither of them would start up.

The company that runs the vps suggested i use csf here but that again wouldnt start up. I then tried modifying IPTables directly, but now that wont start up either. Reading through similar, it looks like its open VZ thats giving me the headache, but is there anyway i can get a firewall up and running on my current set up?


share|improve this question
Ufw, and others are using iptables. What is the error message that you get when adding a new rule with iptables? If it's something like "no INPUT chain" then your provider did not enable all the iptable capabilities for containers. Also you want to check if your on VENET or VETH. – Aleksandr Levchuk Oct 1 '11 at 16:04

You may need to enable some additional iptables modules for your VPS. You will need to ask your host to add the following iptables modules (for a typical firewall) support to your VPS,

ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp

I am not sure, whether they are going to enable all this :)

share|improve this answer
+1 sparx. The conntrack issue is well documented with openvz. Probably won't have much luck getting that working. The OP is probably not going to succeed with this. – jdw Oct 1 '11 at 1:49
@jdw are you talking abou this documentation?… – Aleksandr Levchuk Oct 1 '11 at 16:09
That and others, yes. I haven't run across an OpenVZ host that would support this for me – jdw Oct 1 '11 at 17:15

If your hosting provider will not enable the required additional iptables modules here is the solution I have come up with for using ufw on an OpenVZ virtualisation instance (I have only tested this on MediaTemple):

Install ufw:

sudo apt-get install ufw

Turn IPv6 off:

Edit /etc/default/ufw

On line 7 change IPV6=yes to IPV6=no

Edit /etc/ufw/after.rules

Comment out line 27

# don't log noisy broadcast
# -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input

Edit /etc/ufw/before.rules

Comment out Line 48, 51, 54, 57, 58

# -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN

# -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN

# -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN

# all other non-local packets are dropped
# -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
# -A ufw-not-local -j DROP

Remember to allow port 22 or whatever you use for SSH, then enable the firewall:

sudo ufw allow 22
sudo ufw enable
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.