If a machine does not have iptables installed, is there still a firewall running?

If yes, how to I disable / change rules?

if I enter the command iptables I receive the response:

iptables v1.4.7: no command specified

[root@ruad1 ~]# iptables -L
FATAL: Module ip_tables not found.
iptables v1.4.7: can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

I have been searching but all documentation on firewalls for centos seems to refer to iptables.

If I do ip route list, there seems to be a lot of rules?

Edit: Answer to questions in comments:

output of ls -alL /sbin/iptables

-rwxr-xr-x 1 root root 54200 Nov 23 2013 /sbin/iptables 

I receive the following when I do iptables restart

iptables restart output

kernel version:


contents of /lib/modules/2.6.32-5-vserver-amd64


Any command that I issue with iptables (restart, stop ..) all receive the same error as pasted above.

/sbin/iptables output:

iptables v1.4.7: can't initialize iptables table `filter': Permission denied (you must be root)

Perhaps iptables or your kernel needs to be upgraded.

output of touch /tmp/foo; ls -la /tmp/foo

-rw-r--r-- 1 root root 0 Jun 27 16:51 /tmp/foo
  • Are you able to run service iptables restart without errors? Jun 27, 2014 at 8:26
  • I receive the following when I do iptables restart pastebin.com/VyCkZ9Mx
    – girlcoder
    Jun 27, 2014 at 8:32
  • Do you run the commands as root? Your log seems to refer to a non-root user.
    – AndrewQ
    Jun 27, 2014 at 9:25
  • 1
    If iptables -L returns anything other than bash: iptables: command not found... or other shell equivalent, you do in fact have iptables installed. Could you give us the output of ls -alL /sbin/iptables?
    – MadHatter
    Jun 27, 2014 at 9:53
  • 2
    Are you installing openVZ or something on the system? Jun 27, 2014 at 10:06

4 Answers 4


It looks like the machine is running in a virtualized environment, or more specific: in an operating system-level virtualized environment, like LXC, OpenVZ or Virtuozzo. The kernel version (2.6.32-5-vserver-amd64) gives this away.

In such an environment the kernel is shared between the host and the guest systems, and not all kernel APIs are available in VMs. I guess that's the reason why you have a permission error when calling iptables.

When you find out in which environment your machine is running, you might be able to find a solution online:

But you might have to contact the administrator of the host system to make the necessary changes.


Firstly try this command :

iptables -t nat -L

And also check for loaded module list for iptables,might be module is missing.

cat /proc/net/ip_tables_matches

Check the rules in /etc/sysconfig/iptables for any suspicious entry or space character.

Secondly try this:

$ sudo grep -R "options nf_conntrack ip_conntrack_disable_ve0=1" /etc/modprobe.d/

and replace the "1" with "0":

options nf_conntrack ip_conntrack_disable_ve0=0

reboot your system

  • I cannot issue any iptables commands without error. No file exists in /etc/sysconfig/iptables. the output of cat /proc/net/ip_tables_matches is pastebin.com/2n6Zj4aZ
    – girlcoder
    Jun 27, 2014 at 10:47

Usually, the iptables feature should be included in the basic CentOS 6 installation (w/ minimum network), whereas its active or not depending on modules (ip_tables & iptable_filter) loaded or not.

To enable/disable the iptables, you can use the service command to achieve that. (service iptables start/stop/restart, as listed by TBI infotech.)

With the given logs - "Error: Module ip_tables not found", I looks like your ip_tables module doesn't exist or being relocated to somewhere.

Also, it's possibly your kernel version doesn't match w/ the modules library in your system. Then, you can check the following to confirm

  1. modinfo ip_tables (if failed, it means you can't locate the target module file in your operating kernel.)

  2. look up your running kernel version (uname -r), and your kernel module path should be in the folder "/lib/modules/uname -r/".

  3. Normally, the file "ip_tables.ko" should be in the path "/lib/modules/uname -r/kernel/net/ipv4/netfilter/". Otherwise, your iptables service will not been function.

  • Also, the "no command specified" response is expected when no input parameter to the command "iptables", but "iptables -L" should have the output And, the "ip route list" is just providing the routing information of the system and nothing related to the iptables.
    – YLW
    Jun 27, 2014 at 9:59
  • OK, with a check of your kernel version - 2.6.32-5-vserver-amd64, it seem your kernel is a Debian rather than a centos 6 distribution.
    – YLW
    Jun 27, 2014 at 10:19
  • ah thanks, apologies, I have updated the question, does that change anything with regards to the issue?
    – girlcoder
    Jun 27, 2014 at 10:21

Maybe it's just a problem of the PATH. Try to put /sbin instead of /bin in your PATH definition.

Edit: ah, ok, now you say it's a debian. Whatever.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .