Error: FASTTART: ip6tables-restore: line 14 failed, at line

[daska]

Hello,

after the last update we have the following error.

Error: FASTTART: ip6tables-restore: line 14 failed, at line 3787

and we cannot start lfd
csf is installed in a openvz ct
here the loaded modules

ip6t_REJECT 4711 0
ip6table_mangle 3669 0
ip6table_filter 3033 0
ip6_tables 19714 2 ip6table_mangle,ip6table_filter
ipt_REDIRECT 1888 0
iptable_nat 6302 0
nf_nat 23213 4 vzrst,ipt_REDIRECT,nf_nat_ftp,iptable_nat
iptable_mangle 3493 0
iptable_filter 2937 0
xt_multiport 2716 0
nf_conntrack_ipv4 9946 3 iptable_nat,nf_nat
nf_conntrack 80232 10 xt_conntrack,xt_connlimit,vzrst,vzcpt,nf_nat_ftp,nf_conntrack_ftp,iptable_nat,nf_nat,xt_state,nf_conntrack_ipv4
nf_defrag_ipv4 1531 1 nf_conntrack_ipv4
ipt_LOG 6405 0
ipt_REJECT 2399 0
ip_tables 18151 3 iptable_nat,iptable_mangle,iptable_filter
ipv6 326210 101 vzrst,ip6t_REJECT,ip6table_mangle

and from /proc/user_beancounters

numiptent 24 685 1000 1000 0

[ForumAdmin]

You missed out posting which section failed. Regardless, disable FASTSTART in csf.conf and restart watching for any errors.

[daska]

after disabling FASTSTART csf is running without errors.
where can i read about FASTSTART?

[ForumAdmin]

The FASTSTART option uses the iptables-restore binary to load iptables rules more quickly. However, it is harder to trap specific errors reported by iptables when using it. If you want to try using FASTSTART again, you need to post the full information, including the message which shows which section was being loaded before it failed.

[daska]

i will use it now without faststart because i don't need it.

Thank for your help

[maciekziol]

Hi,

I have exact same problem as daska - I get "Error: FASTTART: ip6tables-restore: line 14 failed, at line 3787" while trying to start CSF. I checked also numiptent it is set high enough. I disabled FASTSTART and restarted CSF manually and I get following errors:

Code: Select all

ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  all opt    in !lo out *  ::/0  -> ::/0   state RELATED,ESTABLISHED
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  all opt    in * out !lo  ::/0  -> ::/0   state RELATED,ESTABLISHED
[...]
ACCEPT  tcp opt -- in !lo out *  0.0.0.0/0  -> 0.0.0.0/0   state NEW tcp dpts:35000:35999
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:20
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:21
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:22
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:25
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:53
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:80
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:110
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:143
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:443
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:465
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:587
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:993
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:995
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in !lo out *  ::/0  -> ::/0   state NEW tcp dpt:2222
[...]
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:20
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:21
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:22
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:25
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:53
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:80
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:110
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:113
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:443
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  tcp opt    in * out !lo  ::/0  -> ::/0   state NEW tcp dpt:2222
ACCEPT  udp opt -- in !lo out *  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:20
ACCEPT  udp opt -- in !lo out *  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:21
ACCEPT  udp opt -- in !lo out *  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:53
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in !lo out *  ::/0  -> ::/0   state NEW udp dpt:20
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in !lo out *  ::/0  -> ::/0   state NEW udp dpt:21
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in !lo out *  ::/0  -> ::/0   state NEW udp dpt:53
ACCEPT  udp opt -- in * out !lo  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:20
ACCEPT  udp opt -- in * out !lo  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:21
ACCEPT  udp opt -- in * out !lo  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:53
ACCEPT  udp opt -- in * out !lo  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:113
ACCEPT  udp opt -- in * out !lo  0.0.0.0/0  -> 0.0.0.0/0   state NEW udp dpt:123
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in * out !lo  ::/0  -> ::/0   state NEW udp dpt:20
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in * out !lo  ::/0  -> ::/0   state NEW udp dpt:21
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in * out !lo  ::/0  -> ::/0   state NEW udp dpt:53
ip6tables: Invalid argument. Run `dmesg' for more information.
ACCEPT  udp opt    in * out !lo  ::/0  -> ::/0   state NEW udp dpt:113
ip6tables: Invalid argument. Run `dmesg' for more information.

Should I post an output of 'dmesg'?

How to deal with it?

[ForumAdmin]

Disable IPV6 in /etc/csf/csf.conf - IPV6 ip6tables is not properly supported in the Virtuozzo/OpenVZ kernels yet.

[maciekziol]

Are You sure? Everything worked properly until last Tuesday morning, so thats why Im asking, dont get me wrong.

Anyway - thanks alot.

[ForumAdmin]

We have yet to see ip6tables working correctly on that particular platform. Nothing in csf changed with regard to the use of IPV6 ip6tables in the v7 release.

[maciekziol]

Ok - as i said, it was only my curiosity .

Again - thanks for quick answer:)