Enable iptables Modules in OpenVZ Containers

Last updated: 30 October 2026

Inside an OpenVZ container, iptables only works if the needed kernel modules are allowed for that container. If a firewall such as CSF or a plain iptables rule fails with "can't initialize iptables table" or "unknown option", the modules are missing. This guide shows how to allow them from the hardware node.

In this guide

• Load modules on the node
• Enable them for a container
• Raise the rule limit
• Verify
• FAQ
• Sources

Load modules on the node

The modules must be loaded on the hardware node first. Virtuozzo documents two ways:

• Host OS: on RHEL-based nodes set IPTABLES_MODULES in /etc/sysconfig/iptables-config. It persists across node reboots and takes effect after a restart.
• vz service: set the IPTABLES parameter in /etc/vz/vz.conf on a single line with no line breaks, then run service vz restart. This restarts all containers, and the modules become available to all of them.

Enable them for a container

To allow a specific list of modules for container 101 and block other loaded modules:

vzctl set 101 --save --iptables ip_table --iptables iptable_filter --iptables ip_conntrack --iptables iptable_nat --iptables iptable_mangle

Restart the container to apply the change:

vzctl restart 101

The older method adds an IPTABLES="iptable_filter iptable_mangle ipt_REJECT ..." line to /etc/vz/conf/101.conf, which does the same job. The vzctl set --save form is safer because it edits the file for you.

Raise the rule limit

vzctl set 101 --save --numiptent 400

Verify

1. Enter the container: vzctl enter 101.
2. Run iptables -L. It should list the chains without errors.
3. Run lsmod on the node to confirm the modules are loaded.

FAQ

Do I have to restart the container?

Yes, changes apply after the container restarts.

Why does iptables still fail?

The module may not be loaded on the node, or your list left out a needed module such as the NAT or conntrack modules.

Is OpenVZ still maintained?

Virtuozzo continues the technology as Virtuozzo and OpenVZ 7, which uses different tooling. Follow the documentation for your version.

Sources

• Virtuozzo support: enabling iptables modules in a container

More on this site: Security guides · All IT guides