Overview
The error message indicating that the VPS iptables rule limit (numiptent) is too low occurs when your hosting provider enforces a maximum threshold on the number of firewall rules your virtual container can generate. This restriction is applied at the hypervisor level and cannot be modified from within the VPS environment. When this limit is reached, features such as country blocklists and IP blocklists may fail to load, as they typically require a higher number of rules than the default threshold allows.
Resolution Steps
To resolve this limitation, your service provider must increase the numiptent value on the host hardware node. Provide them with the following command to execute:
vzctl set CID --numiptent 10000 --saveUser-Side Configuration Adjustments
If your provider is unable or unwilling to increase the limit, you can reduce iptables rule consumption within Juggernaut by applying the following configurations:
- Limit Deny Rules: Navigate to Juggernaut -> Settings -> General Settings. Adjust the deny permanently limit and deny temporarily limit values. The system will automatically rotate older entries to remain within the configured threshold, except for entries explicitly marked with "do not delete".
- Optimize Country Blocklists: Navigate to Juggernaut -> Settings -> Country Settings. Locate the Ignore CIDR blocks smaller than parameter and set it to a value such as /24. This configuration maintains broad country-level blocking while excluding smaller network ranges, significantly reducing the total rule count.
Common Issues & Recommendations
Virtuozzo 6 and earlier versions do not support ipset, which is required for high-performance firewall operations. Major VPS providers, including OVH, DigitalOcean, and Linode, have transitioned to KVM-based virtualization, which fully supports ipset. Additionally, Virtuozzo 7 has also migrated to a KVM architecture. For optimal security performance and rule management capabilities, consider migrating to a KVM-compatible VPS environment.
