Hot answers tagged

33

Two possible options Your PATH does not contain /usr/bin firewall-cmd is not installed yum install firewalld


31

Looks to me like you don't have it installed/enabled. yum install firewalld systemctl unmask firewalld systemctl enable firewalld systemctl start firewalld


13

Docker is VERY lightweight compared to a VM and a VM system should function just fine running containers. Each container essentially does run as an isolated system so it's very good for isolation from a perspective of system stability. Based on your description it sounds like the ideal use case for Docker. If you do experiment with Docker make sure you use ...


10

Due to the update of vzctl from 4.6 to 4.7 they changed the setting of nf_conntrack to be disabled by default. (https://openvz.org/Download/vzctl/4.7/changes) Corresponding commit message: ... Disable conntrack for VE0 by default IP conntrack functionality has some negative impact on venet performance (uo to about 10%), so they better be ...


9

SHORT ANSWER: Your OpenVZ CPU is faster for single-threaded workload than the one used by KVM. On top of that, OpenVZ is a lighter virtualization approach so, all other things being equal, it is somewhat faster than KVM. LONG ANSWER: KVM CPU is a Broadwell Xeon with base/turbo clocks of 2.2-2.9 GHz. OpenVZ uses an Haswell Xeon with base/turbo clocks of 3.0-...


6

I'm not sure if the VM IP addresses show up when you run Netstat, but if they do, this will show you the local addresses with the most TCP connections, sorted by number of connections: netstat -nt | awk '/^tcp/ {print $4}' | awk -F: '{print $1}' | sort | uniq -c | sort -n If you wanted to see the top external addresses with open connections, replace the $4 ...


6

It sounds like you want to specify for traffic to be routed out a particular alias interface and with the source IP associated with that alias. Your route table doesn't currently reflect that requirement. Perhaps you can use this to fix it up: ip route add <NET> dev <ALIAS_DEV> src <SRC_IP>


6

Rsyslog has a tendency to use 100%+ CPU on OpenVZ. I run following commands via SSH to fix the problem service rsyslog stop sed -i -e 's/^\$ModLoad imklog/#\$ModLoad imklog/g' /etc/rsyslog.conf service rsyslog start Or, see here for a workaround.


6

Burst memory is essentially memory that you can use if the host node has memory available and you have exceeded the memory guaranteed to your container. This is a flawed system because applications do not read memory in OpenVZ beancounters. It means that your VPS thinks it has more memory than the host node actually guarantees that you have. For example, if ...


6

Use absolute path to point where each certificate/key is: ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem You can also start the OpenVPN server invoking it's own binary. openvpn --config /etc/openvpn/server.conf --daemon As roaima said, you ...


5

By considering random VPS vs dedicated server with NVMe storage, you are comparing a ride on a bus with buying a sportcar. And no, Virtuozzo, implementing container virtualization here aren't the bottleneck. Instead containers usually introduce less overhead over full virtualization technologies. But as you are renting the VPS your don't really have ...


4

Are your openvz running? If so, try: vzctl enter $vz_ID wher $vz_ID is the container ID (output of vzlist). This will give you root access and you will then be able to change your password. Anyway, with root access on the host, you can always edit the passwd and shadow files located at /vz/private/$vz_ID/etc/passwd and /vz/private $vz_ID/etc/shadow to ...


4

May I ask what the hell for? Check: http://kb.simplywebhosting.com/idx/6/067/article/ The "Unit" has no specific meaning but defines priority. So, one 10, another 20 means the second gets - when CPU is the limit - twice as much power than the first. Over 500k in granularity sounds - non,sensible.


4

man openvpn: --local host Local host name or IP address for bind. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces. So, if you do not specify any "local" directive, openvpn server will listen on all interfaces. You can check this with netstat -nlp. You should see something like: udp ...


4

Can you restart the network service? (on the openvz host.. etc..) Yes What will happen? Best case scenario: Nothing (horribly detrimental that is) Worst Case: Loss of networking on the host. Loss of any connectivity to the host. Loss of any connectivity to the VMs. Critical Application failures on the VMs due to network connectivity issues. Corruption of ...


4

Use -j MASQUERADE (taken from CentOS docs): To allow LAN nodes with private IP addresses to communicate with external public networks, configure the firewall for IP masquerading, which masks requests from LAN nodes with the IP address of the firewall's external device (in this case, eth0): [root@myServer ~ ] # iptables -t nat -A POSTROUTING -o eth0 ...


4

Decision about routing or bridging are functional more than technical; there are pros and cons and its a choice. I prefer routing if I have only one interface, because this way let me having a single point of control (the HN) and on it, I can put some iptables or extra-protection for container which are not by default accessible from the Internet. If you ...


4

You should be super user to run iptables. Therefore, run it as root. $ iptables -t nat -L iptables v1.4.19.1: can't initialize iptables table `nat': Permission denied (you must be root) Perhaps iptables or your kernel needs to be upgraded. # iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination [...]


4

Okay, it turns out that most information that one will find by doing google searches about using iptables inside OpenVZ VM's is obsolete I solved the issue by doing the following: Load all IPTABLES modules on the host node (I may remove some after this) Inside /etc/vz/vz.conf: IPTABLES_MODULES="iptable_filter, iptable_mangle, ipt_limit, ipt_multiport, ...


4

You didn't specify, but from your ifconfig -a excerpt we can assume you're running ipsec inside OpenVZ VE, not hardware node (HN). Just to be sure — did you check out theirs recommendation for that kind of set-up? OpenVZ's templates for VEs are really mind-blowing sometimes. I asked the devs why would one want to use 127/8 range IPs on non-loopback ...


4

This worked for me: --exclude "*/dirname/*" Using aws-cli version 1.11.103.


3

You can do one, or both, of two things: Reduce the amount of space in use by shrinking or removing logical volumes in the volume group. Add more space to the volume group by adding another physical volume, such as another disk array.


3

It sort of depends on what you are doing. OpenVZ is excellent from a hosting perspective because it's a very efficient use of hardware. All unused resources are available for use. So you can have higher container density and that can get passed on to customers in the form of lower per container prices. With KVM any memory or HD space that the customer is ...


3

I had the same issue - using an OpenVZ container, outbound HTTP and HTTPS were blocked when the inbound filter was on; everything was blocked when the egress filter was on. The solution is to set the IPTABLES configuration of your container from your hardware. On my server, the default was (in /etc/vz/vz.conf on the hardware): IPTABLES="ipt_REJECT ipt_tos ...


3

In the node definition, you are not using the class virt, but the custom type virt. You'll find it in modulename/lib/puppet/type. It needs a provider, (modulename/lib/puppet/provider) but cannot find one suitable for your system. To include the class virt, you could use one of the following: include virt or class ( 'virt': } The reason it's not working;...


3

Use vzlist with the diskspace option, for instance: vzlist -a -o ctid,hostname,diskspace -s diskspace


3

This sounds like a problem with your VPS provider. Maybe you were moved onto another system that is oversubscribed (or you stayed on the same box and the CPUs you are getting are oversubscribed - or the box doesn't have enough memory so its swapping [ when I say the box, I mean the server, not your Virtual Machine ]


3

Do you have access to physical OpenVZ node? If yes, you should enable connection tracking using this command: vzctl set XXX --netfilter stateful --save And restart container: vzctl restart XXXX Where XXX is your container ID. If you don't have any access to physical server, you may send this command to your administrator or hosting provider because ...


3

Sounds like it may be set in mysqld_safe. There was once an ancient bug about this. Recall the mysqld_safe calls mysqld from within an indefinite loop. Goto the OS and run the following: grep -n nice `which mysqld_safe` This will show you all places where nice is set, defaulted and used I just ran this on a CentOS VM that's running MySQL 5.5.20 [~]# ...


3

I'm developing openvzmod, yet another role with modules to manage OpenVZ containers. Please give it a try and drop me a line at the issue tracker if you have any comments.


Only top voted, non community-wiki answers of a minimum length are eligible