Hi, While looking for a first Debian contribution, I picked this report, filed in 2016 against fail2ban 0.8.13-1.
I was not able to reproduce the problem against the version currently in unstable (1.1.0-11). Looking at config/action.d/iptables.conf, the "protocol" option is now processed through a generic loop that splits the value on commas and issues one `-p <proto>` iptables rule per value: _ipt_for_proto-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do With `protocol = all` (no comma present), the loop runs once with $proto = all, producing a plain `-p all` rule, which iptables accepts natively. I confirmed this manually on a current system: $ sudo iptables -N f2b-test $ sudo iptables -A f2b-test -j RETURN $ sudo iptables -I INPUT -p all -j f2b-test $ sudo iptables -n -L INPUT | grep f2b-test f2b-test all -- 0.0.0.0/0 0.0.0.0/0 The chain is created and the rule is accepted without error, so the ctionstart/actioncheck sequence described in the original report no longer fails. The changelog doesn't reference this bug number, so my guess is this was fixed as a side effect of the later work adding support for comma-separated protocol lists (protocol = tcp,udp), rather than intentionally for this report. I'm new to Debian packaging, so I'll leave the actual closing to the maintainers in case there's an edge case I'm missing (e.g. a firewall backend other than plain iptables, or an older/newer iptables version with different behaviour for "-p all"). Happy to dig further if useful. Thanks, Germano Castanho
