How to setup iptables on vds with openvz virtualization?

Question

linux

There is a vds from firstvds.ru, unfortunately, with openvz virtualization, not kvm. This vps seems to be missing the conntrack module, judging by this link and the fact that the command

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

gives an error iptables: No chain/target/match by that name.. Ok, I tried to do without this rule. Wrote the following rules for iptables

-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -j DROP

Everything seems to be fine. Only ports 22, 80 and 443 are open outside. The rest are closed. But the problem is that outgoing connections are also blocked. Because the usual ping to Yandex or any other request to an external site does not work. The FORWARD and OUTPUT chains are empty. If you remove the last rule -A INPUT -j DROP, then outgoing requests come and go, but all ports outside become open.
As I understand it, this is due to the lack

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

. Is there any way to do without this rule? Or do you still need to move to a VDS with kvm virtualization?

Answer 1

First, what distribution are we talking about? Perhaps you have firewalld instead of iptables, that's why it doesn't work. When asking questions of this type, you need to show what you have in all tables and chains:
Secondly, it is logical that something does not work in OpenVZ containers, because the capabilities of the host kernel are used, but the module you need is not loaded there, and you do not have rights to it. If you don't like it, then you need to switch either to another hoster or to KVM.
Just check next time like this:
Thirdly, judging by the link to the hoster's forum, you will not succeed - such a policy.
Therefore, you will have to filter according to the principle "everything that is not prohibited is allowed":

iptables -A INPUT -p tcp -m tcp -s X.X.X.X --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 3306 -j DROP

You can understand that you can block like this:
either nmap from another host.
Put in the rules only blocking for specific services and don't worry about the rest.

Answer 2

Most likely, you need to move to a VDS with KVM virtualization. And if you want normal support (without the ISPManager panel), then move from FirstVDS to an adequate provider.

Answer 3

Try state:
Z.Y. better instead of -A INPUT -j DROP do -P INPUT DROP