I'm running CentOS 8 Webserver and recently I had some issues with the CSF Firewall, the CSF Service is running but the LFD is failed.
I did some research and I was able to fix it by doing iptables --flush (I'm not sure it was the problem however!).
Yet, it seems that there is a problem with iptables service, when I start it I get this error:
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Tue 2021-06-22 23:46:44 EET; 13min ago
Process: 11362 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=1/FAILURE)
Main PID: 11362 (code=exited, status=1/FAILURE)
Jun 22 23:46:44 server.ahmedsuror.com systemd[1]: Starting IPv4 firewall with iptables...
Jun 22 23:46:44 server.ahmedsuror.com iptables.init[11362]: iptables: Applying firewall rules: iptables-restore v1.8.4 (nf_tables): Chain 'INVDROP' does not exist
Jun 22 23:46:44 server.ahmedsuror.com iptables.init[11362]: Error occurred at line: 5
Jun 22 23:46:44 server.ahmedsuror.com iptables.init[11362]: Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Jun 22 23:46:44 server.ahmedsuror.com iptables.init[11362]: [FAILED]
Jun 22 23:46:44 server.ahmedsuror.com systemd[1]: iptables.service: Main process exited, code=exited, status=1/FAILURE
Jun 22 23:46:44 server.ahmedsuror.com systemd[1]: iptables.service: Failed with result 'exit-code'.
Jun 22 23:46:44 server.ahmedsuror.com systemd[1]: Failed to start IPv4 firewall with iptables.
Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
I've revised the /etc/sysconfig/iptables file and it seems that the INVDROP chain is the problem, but after a long research I found that this chain is created and managed by CSF.
What is the problem, and if the CSF and LFD are working correctly should I bother?
Also, I've tested the iptables using the Perl script at /etc/csf/csftest.pl and all are OK:
[root@server csf]# perl csftest.pl
Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing ipt_owner/xt_owner...OK
Testing iptable_nat/ipt_REDIRECT...OK
Testing iptable_nat/ipt_DNAT...OK
RESULT: csf should function on this server
Any help is greatly appreciated...
0 Answers