Package: ferm
Version: 2.7-8
Severity: normal
Dear Maintainer,
At boot ferm fails.
sudo systemctl status ferm-early
[sudo] Mot de passe de prahal :
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service; enabled;
preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 2min 21s ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Process: 2072 ExecStart=/usr/libexec/ferm/ferm-systemd activate_early
(code=exited, status=0/SUCCESS)
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules:
/usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules activated
successfully
prahal ~ sudo systemctl status ferm
× ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled; preset:
enabled)
Active: failed (Result: exit-code) since Sat 2026-08-15 04:13:52 CEST;
2min 16s ago
Invocation: 8755fafd7aff4c03966f34de2b382782
Docs: man:ferm(1)
Process: 2876 ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early
(code=exited, status=0/SUCCESS)
Process: 2891 ExecStart=/usr/libexec/ferm/ferm-systemd activate
(code=exited, status=1/FAILURE)
Main PID: 2891 (code=exited, status=1/FAILURE)
Mem peak: 9.3M
CPU: 183ms
août 15 04:13:52 hermes ferm-systemd[2891]: Activating firewall rules:
/usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:13:52 hermes ferm-systemd[2956]: iptables-restore v1.8.13
(nf_tables): Chain 'FORWARD-early' does not exist
août 15 04:13:52 hermes ferm-systemd[2956]: Error occurred at line: 102
août 15 04:13:52 hermes ferm-systemd[2956]: Try `iptables-restore -h' or
'iptables-restore --help' for more information.
août 15 04:13:52 hermes ferm-systemd[2903]: Failed to run
/usr/sbin/iptables-restore
août 15 04:13:52 hermes ferm-systemd[2903]: Firewall rules rolled back.
prahal ~ 3 ls -l /etc/alternatives/iptables*
lrwxrwxrwx 1 root root 22 15 août 03:49 /etc/alternatives/iptables ->
/usr/sbin/iptables-nft
lrwxrwxrwx 1 root root 30 15 août 03:49 /etc/alternatives/iptables-restore ->
/usr/sbin/iptables-nft-restore
lrwxrwxrwx 1 root root 27 15 août 03:49 /etc/alternatives/iptables-save ->
/usr/sbin/iptables-nft-save
prahal ~ ls -l /etc/alternatives/ip6tables*
lrwxrwxrwx 1 root root 23 15 août 04:09 /etc/alternatives/ip6tables ->
/usr/sbin/ip6tables-nft
lrwxrwxrwx 1 root root 31 15 août 04:09 /etc/alternatives/ip6tables-restore ->
/usr/sbin/ip6tables-nft-restore
lrwxrwxrwx 1 root root 28 15 août 04:09 /etc/alternatives/ip6tables-save ->
/usr/sbin/ip6tables-nft-save
Note I don't have a vanilly Debian ferm setup but a debops one (ie
/etc/ferm/ferm.conf is not Debian vanilla). But it
seems unrelated to current issue.
Best Regards,
Alban
-- System Information:
Debian Release: forky/sid
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'stable-debug'), (500,
'oldstable-debug'), (500, 'testing'), (500, 'stable'), (90, 'unstable-debug'),
(90, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 7.1.7+deb14-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages ferm depends on:
ii iptables 1.8.13-1
ii perl 5.42.2-3
ii systemd [systemd-tmpfiles] 261.2-1
Versions of packages ferm recommends:
pn libnet-dns-perl <none>
ferm suggests no packages.
-- Configuration Files:
/etc/default/ferm changed:
FAST=yes
CACHE=no
OPTIONS=
ENABLED="yes"
/etc/ferm/ferm.conf changed:
@include 'rules.d/';
-- debconf information:
* ferm/enable: yes
-- debsums errors found:
debsums: changed file /usr/libexec/ferm/ferm-systemd (from ferm package)
