From HostThyself

Add required iptables modules to

/etc/vz/vz.conf

To enable stateful firewall,

modprobe xt_state

Add 'ipt_state' to 'IPTABLES' option in vz.conf file

A restart of the container is required.

see also how to load kernel module at boot up on CentOS.

[edit] Reference

• Setting up an iptables firewall