0

I am running CentOS 7 VPS which I purchsed preconfigured with iptables installed, but I didn't check this at first. I know CentOS 7 "should" be firewalled, so I installed firewalld and no error presented itself.

Later on, when I tried to start the daemon via systemctl start firewalld, the program crashed shortly afterwards without showing any error.

I ran systemctl status firewalld to make sure the firewall was running and got the following output:

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2019-11-19 08:35:39 EST; 1min 35s ago
     Docs: man:firewalld(1)
  Process: 27356 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
 Main PID: 27356 (code=exited, status=0/SUCCESS)

Nov 19 08:35:37 vps.blabla.com systemd[1]: Starting firewalld - dynamic ....
Nov 19 08:35:38 vps.blabla.com systemd[1]: Started firewalld - dynamic f....
Nov 19 08:35:39 vps.blabla.com firewalld[27356]: WARNING: ipset not usabl...
Nov 19 08:35:39 vps.blabla.com firewalld[27356]: ERROR: Failed to load nf...
                                            modprobe: ERROR: could n...
                                            modprobe: ERROR: Error r...
Nov 19 08:35:39 vps.blabla.com firewalld[27356]: ERROR: Raising SystemExi...
Hint: Some lines were ellipsized, use -l to show in full.

I dug into it using systemctl status firewalld -l and got the following:

* firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2019-11-19 08:35:39 EST; 13min ago
     Docs: man:firewalld(1)
  Process: 27356 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
 Main PID: 27356 (code=exited, status=0/SUCCESS)

Nov 19 08:35:37 vps.blabla.com systemd[1]: Starting firewalld - dynamic firewall daemon...
Nov 19 08:35:38 vps.blabla.com systemd[1]: Started firewalld - dynamic firewall daemon.
Nov 19 08:35:39 vps.blabla.com firewalld[27356]: WARNING: ipset not usable, disabling ipset usage in firewall.
Nov 19 08:35:39 vps.blabla.com firewalld[27356]: ERROR: Failed to load nf_conntrack module: modprobe: ERROR: could not find module by name='nf_conntrack'
   modprobe: ERROR: could not insert 'nf_conntrack': Function not implemented
   modprobe: ERROR: Error running install command for nf_conntrack
   modprobe: ERROR: could not insert 'nf_conntrack': Operation not permitted
Nov 19 08:35:39 vps.blabla.com firewalld[27356]: ERROR: Raising SystemExit in run_server

Then I started to dig deeper and found that my server already had iptables installed and configured with some open ports and more. I assume that the error comes from the fact I have already have one firewall running. My research showed that people say these two firewalls in the same server may conflict.

The problem:

1) If I remove the firewalld (which, as pointed by many on the web, is newer and is the future), will it cause me to be "locked out"?
2) If I would like to remove the iptables and use firewalld, is it even possible to achieve similar configuration as in iptables without getting "locked out"?

Note: The only access I have to the server now is via SSH, and I am root user.

Thanks a lot

5
  • I don't think you have any firewalls running, they are inactive. You should be able to connect to any port if you have them open in your cloud provider's ACL.
    – Vignesh SP
    Nov 19, 2019 at 14:55
  • So it is unsafe.... ? Or shall I leave it this way? I believe is better if I activate one firewall, correct me if I am wrong.
    – Xerix
    Nov 20, 2019 at 1:17
  • Hard to comment without knowing the purpose, I actually never run firewalls on my host machines. I manage them with aws’s security group. AWS is my cloud vendor. I never use it because I have never had a real reason to use it.
    – Vignesh SP
    Nov 20, 2019 at 3:15
  • I don't think your errors relate to the 2 firewalls. I'm pretty sure it relates to missing or not-loading kernel modules. Also, I believe firewalls is an abstraction layer for iptables.
    – davidgo
    Nov 20, 2019 at 8:42
  • Maybe this can explain how come there is "iptables" in CentOS 7, though I thought it has built in firewalld to replace "iptables".... Kernel modules suppose to be there by default, as far as I know, unless someone removed them.... (Or maybe I am wrong)
    – Xerix
    Nov 20, 2019 at 9:08

1 Answer 1

1

You don't have 2 firewalls running. firewalld is a management tool that relies on an actual filtering system to do the heavy lifting of allowing/blocking traffic. This is usually iptables, but many distributions are moving towards nftables to replace iptables.

CentOS 7 is still using iptables as the backend for firewalld. Those errors are firewalld trying to initialize the iptables system, however it cannot load (some of) the required kernel modules.

Perhaps you've upgraded the kernel without rebooting? Or this is not a true VPS but a container-based VPS instead (eg, OpenVZ) where you don't have access to load/unload kernel modules.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .