今天我在主机系统上的iptables nat停止工作,我不知道发生了什么！ (这很糟糕,我知道)
@H_502_1@所有命令都以root用户身份执行.@H_301_2@
@H_502_1@如果我运行$iptables -t nat -L我收到以下错误消息：@H_301_2@
我还用几个较旧的内核重新启动了服务器,但我总是得到相同的错误消息.@H_301_2@ @H_502_1@我的服务器在CentOS上运行,最新版本的官方OpenVZ内核.@H_301_2@
$iptables -t nat -L iptables v1.4.7: can't initialize iptables table `nat': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded.@H_502_1@没有进一步的更新.
我还用几个较旧的内核重新启动了服务器,但我总是得到相同的错误消息.@H_301_2@ @H_502_1@我的服务器在CentOS上运行,最新版本的官方OpenVZ内核.@H_301_2@
$uname -r 2.6.32-042stab088.4@H_502_1@还测试了内核版本：2.6.32-042stab85.20和2.6.32-042stab084.26@H_301_2@ @H_502_1@grub.conf中的第一个内核：@H_301_2@
title OpenVZ (2.6.32-042stab088.4) root (hd0,1) kernel /vmlinuz-2.6.32-042stab088.4 ro root=/dev/md2 rd_NO_LUKS rd_NO_DM nomodeset crashkernel=auto SYSFONT=latarcyrheb-sun16 LANG=en_US.UTF-8 KEYTABLE=de initrd /initramfs-2.6.32-042stab088.4.img@H_502_1@安装了以下更新：@H_301_2@
$rpm -qa --last vzctl-4.7.2-1.x86_64 Mon 05 May 2014 03:25:16 AM CEST vzctl-core-4.7.2-1.x86_64 Mon 05 May 2014 03:25:14 AM CEST util-linux-ng-2.17.2-12.14.el6_5.x86_64 Wed 30 Apr 2014 11:37:19 PM CEST libuuid-2.17.2-12.14.el6_5.x86_64 Wed 30 Apr 2014 11:37:18 PM CEST libblkid-2.17.2-12.14.el6_5.x86_64 Wed 30 Apr 2014 11:37:18 PM CEST vzkernel-2.6.32-042stab088.4.x86_64 Mon 26 Apr 2014 09:01:00 AM CEST nss-softokn-freebl-3.14.3-10.el6_5.x86_64 Sat 26 Apr 2014 09:01:00 AM CEST nss-softokn-3.14.3-10.el6_5.x86_64 Sat 26 Apr 2014 09:01:00 AM CEST bridge-utils-1.2-10.el6.x86_64 Tue 15 Apr 2014 02:22:41 PM CEST openssl-1.0.1e-16.el6_5.7.x86_64 Wed 09 Apr 2014 10:14:03 AM CEST ...@H_502_1@lsmod给了我以下内容：@H_301_2@
$lsmod | grep ip iptable_nat 6302 0 nf_nat 23213 2 iptable_nat,vzrst nf_conntrack_ipv4 9946 3 iptable_nat,nf_nat nf_defrag_ipv4 1531 1 nf_conntrack_ipv4 nf_conntrack 80281 5 iptable_nat,vzrst,nf_nat,nf_conntrack_ipv4,vzcpt ip6t_REJECT 4711 0 ip6table_mangle 3669 0 ip6table_filter 3033 0 ip6_tables 18988 2 ip6table_mangle,ip6table_filter iptable_mangle 3493 0 iptable_filter 2937 0 xt_multiport 2716 0 ipt_REJECT 2399 0 ip_tables 18119 3 iptable_nat,iptable_mangle,iptable_filter ipv6 322519 35 vzrst,ip6t_REJECT,ip6table_mangle@H_502_1@运行modprobe会出现以下错误：@H_301_2@
$modprobe /lib/modules/2.6.32-042stab088.4/kernel/net/ipv4/netfilter/iptable_nat.ko FATAL: Module /lib/modules/2.6.32_042stab088.4/kernel/net/ipv4/netfilter/iptable_nat.ko not found.@H_502_1@但该文件确实存在：@H_301_2@
$ll /lib/modules/2.6.32-042stab088.4/kernel/net/ipv4/netfilter/iptable_nat.ko -rwxr--r-- 1 root root 16K Apr 3 16:20 /lib/modules/2.6.32-042stab088.4/kernel/net/ipv4/netfilter/iptable_nat.ko*@H_502_1@有任何想法吗？@H_301_2@
由于vzctl从4.6更新到4.7,因此默认情况下将nf_conntrack的设置更改为禁用. (
https://openvz.org/Download/vzctl/4.7/changes)
@H_502_1@相应的提交消息：@H_301_2@
@H_502_1@…@H_301_2@ @H_502_1@Disable conntrack for VE0 by default@H_301_2@ @H_502_1@IP conntrack functionality has some negative impact on venet performance (uo to about 10%),so they better be disabled by default.@H_301_2@ @H_502_1@…@H_301_2@ @H_502_1@(Source: 07001)@H_301_2@@H_502_1@解：@H_301_2@
@H_502_1@In dependence of distribution it is somewhere in /etc directory. Find it:@H_301_2@ @H_502_1@$sudo grep -R “options nf_conntrack ip_conntrack_disable_ve0=1” /etc/modprobe.d/@H_301_2@ @H_502_1@and replace the “1” with “0”:@H_301_2@ @H_502_1@options nf_conntrack ip_conntrack_disable_ve0=0@H_301_2@ @H_502_1@reboot your system@H_301_2@ @H_502_1@(Source: 07002)@H_301_2@@H_502_1@或者重启：@H_301_2@
rmmod iptable_nat rmmod nf_nat rmmod nf_conntrack_ipv4 rmmod nf_conntrack@H_502_1@nat现在正在工作@H_301_2@ @H_502_1@所有来源：@H_301_2@ @H_502_1@vzctl 4.7：https://openvz.org/Download/vzctl/4.7/changes的更改日志@H_301_2@ @H_502_1@错误报告与评论中的解决方案：https://bugzilla.openvz.org/show_bug.cgi?id=2943@H_301_2@ @H_502_1@具有缩短解决方案描述的错误报告：https://bugzilla.openvz.org/show_bug.cgi?id=2755#c4@H_301_2@ @H_502_1@相应的GIT提交：http://git.openvz.org/?p=vzctl;a=commit;h=a191a462579ee@H_301_2@ @H_502_1@相关维基文章：https://openvz.org/NAT#IP_conntracks@H_301_2@
