系统环境
CentOS 6.5
今天本来可以平静的度过一天,正品味着下午茶的美好,突然接到防火墙iptables的报警。
进入到服务器中,执行下面的命令查看,结果报错
/etc/init.d/iptables restart
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
一个醒目的失败突然出现
为什么重启防火墙就失败了呀,十分不解,看下报错
报错中说 无法找到初始化的表filter,然而策略中第三行正是filter
但是回想了下,防火墙的策略是没人动的呀,用last查看下
last
最近登陆的除了我自己也没别人
难道自己梦游了?用history查看下修改过策略么
history
也没有呀
那是为什么突然报错呢,在网上找了很多相关的文章
他们说的最多的就是执行
iptables -F
强制清空防火墙规则,
于是我将防火墙策略先备份,备份大于一切
cd /etc/sysconfig;cp iptables iptables.2018bak
执行iptables -F
结果又报错了!
[root@zclinux ~]# iptables -F
iptables v1.4.7: can't initialize iptables table `filter': iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
这又是啥! 还是提示filter无法找到
查看下防火墙状态是开启还是已经关闭了
结果又有报错
/etc/init.d/iptables status
iptables: Firewall modules are not loaded.
但是报错不一样了,提示我防火墙的模块没有被加载。什么鬼!防火墙模块没有被加载
那我就查看下防火墙模块是否加载了
lsmod | grep iptable
成功执行,但是没有任何有价值的内容,这和我预想不得一样啊
那我手动加载一下试试
modprobe ip_tables
modprobe iptable_filter
上面两句都是在网上找的。地址如下:
iptables提示:Firewall modules are not loaded_Benson_xuhb的博客-CSDN博客
但是还是没有回显,那还是加载失败呀。
突然想到,防火墙规则要清空的话,我手动清空试下,就将防火墙的配置文件iptables中只留下了头部和COMMIT再次重启,还是老错误
/etc/init.d/iptables restart
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
那我先停止在开启呢
于是分别执行如下命令:
/etc/init.d/iptables stop
/etc/init.d/iptables start
我去,都执行成功了,但是为啥没显示ok呢,回忆里都是会有一个ok的呀,不管了,查看下状态
/etc/init.d/iptables status
iptables: Firewall modules are not loaded.
还是报错
同事推荐我在别的服务器中拷贝一个好的iptables文件试下,看是不是文件损坏,结果拷贝回来放在服务器中替换掉,还是报错,报错如上,升级yum,升级内核,升级防火墙 ,reinstall防火墙,reboot全都无果,特别难受,绝望的边缘!!
算了,还是从内核入手看下,他说的模块有问题,我记得加载模块一种是自动查找,一种是手动加载
查看下相关的文章:
文章地址:can't initialize iptables table `nat': Table does not exist_路的方向。迷茫的技术博客_51CTO博客
我这一看,这第二种刚好符合我的要求,和我的报错类似,但是不同
照着做下;
#modprobe -l|grep iptable
kernel/net/ipv4/netfilter/iptable_filter.ko
kernel/net/ipv4/netfilter/iptable_mangle.ko
kernel/net/ipv4/netfilter/iptable_nat.ko
kernel/net/ipv4/netfilter/iptable_raw.ko
kernel/net/ipv4/netfilter/iptable_security.ko
有希望,找到了那个有问题的内核iptable_filter.ko
查看下内核的相关信息
modinfo iptable_filter
filename: /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko
description: iptables filter table
author: Netfilter Core Team <coreteam@netfilter.org>
license: GPL
retpoline: Y
srcversion: 666666666666666666668 --已打码
depends: ip_tables
vermagic: `uname -r` SMP mod_unload modversions
parm: forward:bool
导入试下,结果全都失败了
insmod /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko
insmod: error inserting '/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko': -1 Unknown symbol in module
modprobe /lib/modules/`uname -r`kernel/net/ipv4/netfilter/iptable_filter.ko
FATAL: Module /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko not found.
我这回直接进到路径底下查看是否存在这个内核:
cd /lib/modules/`uname -r`/kernel/net/ipv4/netfilter
...
-rwxr--r-- 1 root root 8960 Oct 10 00:42 iptable_filter.ko
-rwxr--r-- 1 root root 9008 Oct 10 00:42 iptable_mangle.ko
-rwxr--r-- 1 root root 16232 Oct 10 00:42 iptable_nat.ko
-rwxr--r-- 1 root root 7248 Oct 10 00:42 iptable_raw.ko
-rwxr--r-- 1 root root 7904 Oct 10 00:42 iptable_security.ko
-rwxr--r-- 1 root root 37512 Oct 10 00:42 ip_tables.ko
....
这正是我所需要的,哈哈哈哈哈
再次执行命令:
[root@zclinux netfilter]# insmod ip_tables.ko #我感觉应该限制性这个,才对,再执行后面的
[root@zclinux netfilter]# insmod iptable_filter.ko
#lsmod | grep ip #查看下是否导入成功
iptable_filter 2793 0
ip_tables 17895 1 iptable_filter
ipv6 337436 30
nice 导入成功
/etc/init.d/iptables restart
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
还是failed! what 不对,换个思路
iptables -vnL
iptables v1.4.7: can't initialize iptables table `filter': iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
还是报错,但是已经导进去了呀!
查看下:
#lsmod | grep ip
ipv6 337436 30
没了,一个都没有了
再导入一遍
[root@zclinux netfilter]# insmod ip_tables.ko
[root@zclinux netfilter]# insmod iptable_filter.ko
#lsmod | grep ip #查看下是否导入成功
iptable_filter 2793 0
ip_tables 17895 1 ipt
这回我先执行stop
/etc/init.d/iptables stop
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
good 关闭正常,看到ok瞬间清爽,在开启!
/etc/init.d/iptables start
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
一千万至羊驼从身边踏过!
再来,先看下防火墙状态是否是关闭
/etc/init.d/iptables status
iptables: Firewall is not running.
ok 已经不显示模块加载失败了,成功仅在咫尺
lsmod | grep ip #查看下模块还在吗
ipv6 337436 30
再来一遍
[root@zclinux netfilter]# insmod ip_tables.ko
[root@zclinux netfilter]# insmod iptable_filter.ko
[root@zclinux netfilter]# lsmod | grep ip
iptable_filter 2793 0
ip_tables 17895 1 iptable_filter
ipv6 337436 30
加载成功!
启动防火墙!
[root@zclinux netfilter]# /etc/init.d/iptables start
iptables: Applying firewall rules: [ OK ]
启动防火墙成功!!!!
查看下策略咋样
[root@zclinux netfilter]# iptables -vnL
Chain INPUT (policy ACCEPT 295 packets, 34096 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 270 packets, 41311 bytes)
pkts bytes target prot opt in out source destination
忘了把策略加进去了,再来
[root@zclinux netfilter]# /etc/init.d/iptables stop
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
[root@zclinux netfilter]# /etc/init.d/iptables start
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
再来一遍
[root@zclinux netfilter]# lsmod | grep ip
ipv6 337436 30
[root@zclinux netfilter]# insmod ip_tables.ko
[root@zclinux netfilter]# insmod iptable_filter.ko
[root@zclinux netfilter]# lsmod | grep ip
iptable_filter 2793 0
ip_tables 17895 1 iptable_filter
ipv6 337436 30
[root@zclinux netfilter]# /etc/init.d/iptables start
iptables: Applying firewall rules: [ OK ]
[root@zclinux netfilter]# iptables -vnL
哈哈哈哈哈 规则回来了,都在抓紧写个脚本进行检测
[root@zclinux ~]# vi checkiptables_module.sh
#!/bin/bash
DATE=`date '+%Y-%m-%d %H:%M:%S' `
check=`lsmod | grep ip | grep iptable | awk -F" " '{print $4}'| grep ip`
if [ "$check" -eq 'iptable_filter' ]
then
echo $DATE "- iptables is ok ! " >>/tmp/iptables_check.log
else
/etc/init.d/iptables stop
cd /lib/modules/`uname -r`/kernel/net/ipv4/netfilter;
insmod ip_tables.ko;
insmod iptable_filter.ko;
/etc/init.d/iptables start;
echo $DATE "-iptables is restore ! " >> /tmp/iptables_check.log
fi
chmod +x /root/checkiptables_module.sh
把脚本加如到执行计划中
crontab -e
* */1 * * * /root/checkiptables_module.sh
收官,不知道为啥,这个防火墙内核只能这样了,文中所有涉及到服务器的真实信息已被打码修改。
------------------------------分割线---------------------------------------------------------
环境centos7.3
问题: 出现iptables -vnL
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
和上述问题一直,但细节部分有点不同
还是调用内核模块
lsmod | grep ip
发现里面没有任何显示,这就证明iptables的几个内核有问题
尝试手动加载内核
modprobe ip_tables
modprobe ip_tables
输入完成后,再次查看,还是没有任何内核关于iptables的模块被加载
执行全部内核加载命令:
depmod -a
但是突然报错:
#depmod -a
depmod: ERROR: could not open directory /lib/modules/3.10.0-514.el7.x86_64: No such file or directory
depmod: FATAL: could not search modules: No such file or directory
提示找不到文件
这句很重要,找不到文件的话,就无法加载内核
手动查找下
find / -name 3.10.0-514.el7.x86_64
/usr/lib/modules/3.10.0-514.el7.x86_64
只有这个下面有一个,手动复制一份到/lib下
cp -r /lib/ /lib.bak/
cp -r /usr/lib/* /lib/
再次执行
depmod -a
执行成功
查看模块加载情况:
lsmod | grep ip
手动添加
modprobe ip_tables
modprobe ip_tables
再次查看添加成功
lsmod | grep ip
iptable_filter 12810 0
ip_tables 27115 1 iptable_filter
iptables -vnL正常
在没加载模块之前,防火墙重启后,持续报这个错误:
systemctl restart iptables
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.
查看状态后:
systemctl status iptables
? iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Tue 2019-01-08 12:33:38 ICT; 38s ago
Process: 2959 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=1/FAILURE)
Main PID: 2959 (code=exited, status=1/FAILURE)
Jan 08 12:33:38 manager systemd[1]: Starting IPv4 firewall with iptables...
Jan 08 12:33:38 manager iptables.init[2959]: iptables: Applying firewall rules: iptables-restore v1.4.21: iptabl...lter'
Jan 08 12:33:38 manager iptables.init[2959]: Error occurred at line: 4
Jan 08 12:33:38 manager iptables.init[2959]: Try `iptables-restore -h' or 'iptables-restore --help' for more inf...tion.
Jan 08 12:33:38 manager iptables.init[2959]: [FAILED]
Jan 08 12:33:38 manager systemd[1]: iptables.service: main process exited, code=exited, status=1/FAILURE
Jan 08 12:33:38 manager systemd[1]: Failed to start IPv4 firewall with iptables.
Jan 08 12:33:38 manager systemd[1]: Unit iptables.service entered failed state.
Jan 08 12:33:38 manager systemd[1]: iptables.service failed.
Hint: Some lines were ellipsized, use -l to show in full.
[root@manager ~]# lsmod | grep ipta
[root@manager ~]# lsmod | grep ip
[root@manager ~]# depmod -a
depmod: ERROR: could not open directory /lib/modules/3.10.0-514.el7.x86_64: No such file or directory
depmod: FATAL: could not search modules: No such file or directory
网上很多都说是由于firewalld服务造成的,于是关闭firewalld
systemctl stop firewalld
sysetmctl disable firewalld
但重启还是报错,这个不是问题的根本
于是尝试上述的加载内核成功后,重启iptables,启动也成功
定位问题要快准狠,多看日志多看报错
总结下还是/lib路径下的文件有产生变化,和/usr/lib下的文件不同步造成,手动复制到/lib下,正常启动