Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Where should I load iptables modules, for example ip_conntrack and ip_conntrack_ftp.

Places I have found that might be candidates, but are they?

  • The IPTABLES_MODULES variable in /etc/init.d/iptables
  • In /etc/modprobe.conf
  • In /etc/modprobe.d/xxxx.conf
share|improve this question

2 Answers 2

up vote 5 down vote accepted

None of them.

/etc/rc.d/rc.sysinit looking for two locations to load modules:

# Load other user-defined modules
for file in /etc/sysconfig/modules/*.modules ; do
  [ -x $file ] && $file
done

# Load modules (for backward compatibility with VARs)
if [ -f /etc/rc.modules ]; then
        /etc/rc.modules
fi

So, you should put the loading command into /etc/sysconfig/modules/*.modules or /etc/rc.modules:

# echo "modprobe ip_conntrack" >> /etc/sysconfig/modules/iptables.modules
# chmod +x /etc/sysconfig/modules/iptables.modules
share|improve this answer
    
Looks like you are answering all my questions. This was the general answer to my question, and @Iain had the answer to the problem I actually tried to solve. –  Arlukin Nov 1 '11 at 15:01

For iptables on CentOS there is an additional location which is where I have those particular modules configured to load and that's the /etc/sysconfig/iptables-config file. The start of the file looks like this

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="nf_conntrack_ftp nf_conntrack"

When I run service iptables restart I get this line

Loading additional iptables modules: nf_conntrack_ftp nf_co[  OK  ]

If I play with the contents of the

IPTABLES_MODULES="nf_conntrack_ftp nf_conntrack"

above it changes the output of the Loading additional modules line when I restart the service.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.