iptables not installed on centos

Question

If a machine does not have iptables installed, is there still a firewall running?

If yes, how to I disable / change rules?

if I enter the command iptables I receive the response:

iptables v1.4.7: no command specified

[root@ruad1 ~]# iptables -L
FATAL: Module ip_tables not found.
iptables v1.4.7: can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

I have been searching but all documentation on firewalls for centos seems to refer to iptables.

If I do ip route list, there seems to be a lot of rules?

Edit: Answer to questions in comments:

output of ls -alL /sbin/iptables

-rwxr-xr-x 1 root root 54200 Nov 23 2013 /sbin/iptables 

I receive the following when I do iptables restart

iptables restart output

kernel version:

2.6.32-5-vserver-amd64

contents of /lib/modules/2.6.32-5-vserver-amd64

/lib/modules/2.6.32-5-vserver-amd64

Any command that I issue with iptables (restart, stop ..) all receive the same error as pasted above.

/sbin/iptables output:

iptables v1.4.7: can't initialize iptables table `filter': Permission denied (you must be root)

Perhaps iptables or your kernel needs to be upgraded.

output of touch /tmp/foo; ls -la /tmp/foo

-rw-r--r-- 1 root root 0 Jun 27 16:51 /tmp/foo

Solution 1

It looks like the machine is running in a virtualized environment, or more specific: in an operating system-level virtualized environment, like LXC, OpenVZ or Virtuozzo. The kernel version (2.6.32-5-vserver-amd64) gives this away.

In such an environment the kernel is shared between the host and the guest systems, and not all kernel APIs are available in VMs. I guess that's the reason why you have a permission error when calling iptables.

When you find out in which environment your machine is running, you might be able to find a solution online:

• The knowledge base for Parallels' Virtuozzo has an article on How do I enable firewall in a Container.
• The OpenVZ wiki has an article on Setting up an iptables firewall.

But you might have to contact the administrator of the host system to make the necessary changes.

Solution 2

Firstly try this command :

iptables -t nat -L

And also check for loaded module list for iptables,might be module is missing.

cat /proc/net/ip_tables_matches

Check the rules in /etc/sysconfig/iptables for any suspicious entry or space character.

Secondly try this:

$ sudo grep -R "options nf_conntrack ip_conntrack_disable_ve0=1" /etc/modprobe.d/

and replace the "1" with "0":

options nf_conntrack ip_conntrack_disable_ve0=0

reboot your system

Comments

[TBI Infotech]

Are you able to run service iptables restart without errors?

[girlcoder]

I receive the following when I do iptables restart pastebin.com/VyCkZ9Mx

[AndrewQ]

Do you run the commands as root? Your log seems to refer to a non-root user.

[girlcoder]

yes I see that, I am logged in as root, I do not believe being root is the issue..

[MadHatter]

If iptables -L returns anything other than bash: iptables: command not found... or other shell equivalent, you do in fact have iptables installed. Could you give us the output of ls -alL /sbin/iptables?

[girlcoder]

output of ls -alL /sbin/iptables -rwxr-xr-x 1 root root 54200 Nov 23 2013 /sbin/iptables

[TBI Infotech]

Are you installing openVZ or something on the system?

[girlcoder]

have updated the question

[Admin]

The iptables you have installed doesn't appear to be from any current Debian distribution. dpkg -S /sbin/iptables to confirm it belongs to the iptables package, then apt-cache policy iptables to see if it has a known origin, and debsums iptables to see if it's been locally modified.

[girlcoder]

Wumpus, I am using centos yum, someone answered with the fact that it seemed I was on debian, but I have this /usr/share/kde4/apps/kdm/themes/CentOS6/centos6.xml .. basically I cannot run the commands that you suggest, but thank you

[Admin]

Until a few minutes ago Debian was in the title of this question!

[girlcoder]

@Wumpus, very sorry about that, see comment from user3781593 below. They suggested it was debian, no one disagreed, so I changed the tags, but that was incorrect of me, again, I apologise.

[slafat01]

I do not see where you answered AndrewQ's question... Are you running your commands as root? Your logs refer to you not being root when you run these commands, and yes.... when you try running a command that requires root, and you are running it as a non-root user, sometimes the output is that the command is not found (i.e. - to a user the command is not found, but to root, it is found). I get the same results on my Mageia Linux machine when run as a non-root user, but change to root, and I can run the commands no problem!!

[MadHatter]

Girlcoder, please supply the information sought. I'm asking you to run /sbin/iptables -L and show the prompt, the command being entered, and the output. I don't believe it's going to show what you said it showed (iptables v1.4.7: no command specified). If in fact it shows permission denied, could you try touch /tmp/foo; ls -la /tmp/foo and paste the prompt, command, and output of that into your question?

[girlcoder]

@MadHatter I have put this in the question.. /sbin/iptables output:

[MadHatter]

You have not shown the command being entered nor the prompt. That makes the output hard to analyse , because I don't know what you did to get it. If I take what you're saying at face value, you have produced two completely different outputs from iptables -L, and that is, frankly, highly unlikely.

[girlcoder]

@MadHatter question updated

[Dubu]

Looks like you're running your machine in a virtualized environment, or more specific: an operating system-level virtualized environment, like LXC, OpenVZ or Virtuozzo. (@TBIInfotech assumed something similar, I guess.) In those environments the kernel is shared between the virtual machines, and not all kernel APIs are available in VMs. I guess that's the reason why you have no permission for iptables.

[girlcoder]

@Dubu, thank you, is there a way I can disable the firewall or change the rules?

[MadHatter]

Dubu, honestly, the more we delve into this the more I'm thinking that's the answer - this is all being done on a badly-virtualised system that doesn't allow changes to be made to the iptables module (in which case, no, there's going to be no way to do it). Do you want to write that up as a full answer? I'd upvote it.

[girlcoder]

ok, thanks everyone, it seems this is the problem. are you saying that you will write up the answer, I am not sure I would word it correctly, but I will if thats what you suggest, I will write it, if you write it I will accept the answer.

[Dubu]

@MadHatter I thought that TBIInfotech had the same idea, but he hasn't added anything in the meantime, so I wrote up an answer now.

[YLW]

Also, the "no command specified" response is expected when no input parameter to the command "iptables", but "iptables -L" should have the output And, the "ip route list" is just providing the routing information of the system and nothing related to the iptables.

[YLW]

OK, with a check of your kernel version - 2.6.32-5-vserver-amd64, it seem your kernel is a Debian rather than a centos 6 distribution.

[girlcoder]

ah thanks, apologies, I have updated the question, does that change anything with regards to the issue?

[girlcoder]

I cannot issue any iptables commands without error. No file exists in /etc/sysconfig/iptables. the output of cat /proc/net/ip_tables_matches is pastebin.com/2n6Zj4aZ