I have decided to try out apf, but it didn't turn out to be so easy as I thought. The apf package from atomic repo refuses to install (don't remember the error, but it was reported in the forums). So I downloaded it and compiled it and apf works. But it is missing a few modules. For example xt_tcpudp.ko. the problem is that xt_tcpudp.ko
isn't availible for the newest asl kernel, 2.6.32.16-2.art.x86_64, only for 2.6.18-194.8.1. Is there away around this?

According to this thread this module should already be loaded. But it doesn't seem to be...

have you tried the guide from:
http://www.grafxsoftware.com/faq.php/HOW-TO-Setup-a-PLESK-Dedicated-Server/1/4/ ?
Step 9.Firewall

That's acctually the one I used. And afp loads but I get errors:

iptables: Unknown error 18446744073709551615

Which seems to indicate missing modules...

Is this a dedicated server or a VM of some sort?

That error is often something you get when there's not enough memory, or a limit on the number of rules you can have.

There's more than one way to restart APF, incidentally. I've found that stopping and starting often works when restarting does not (and gives errors like the one you had).

Faris.

I am pretty sure the error comes from the missing module xt_tcpudp.ko. According to mike it is supposed to be loaded, but it is missing from the current ASL kernel as far as I can see...

The server is hosted on VMware ESX server, monokern is enabled. But it has 4 GB RAM associated with it and no domains, users, applications at all (except the new Plesk installation).

Not missing, deprecated. It no longer exists in modern kernels.

OK, thanks for the clarification! Now I just have to find out which module apf really is missing...

I think you misunderstood what I said, that list is not a list of modules that are supposed to be loaded. That was a list of the modules ASL will load if its necessary to load it and if that module or method exists in that version of the kernel. That list includes modules that exist in different generations of the kernel over time and some may not exist in other versions. ASL is smart enough to know which ones to load depending on the generation of the kernel its using. That is not a list of modules that should be loaded, do not use that list to determine if a module is missing in your system. If a module with that name is not in the version of the ASL kernel you have installed its deprecated and not missing and therefore will not be loaded - its not part of the kernel anymore.

Yeah, I understand that now... Sorry for all the confusion but kernel modules is a new concept for me.

With iptables 1.4.7-2 released yeasterday I donät get any more errors! Thanks!