Le 15/08/2026 à 09:55, Marc Haber a écrit :
Hi,
On Sat, Aug 15, 2026 at 04:20:58AM +0200, Alban Browaeys wrote:
sudo systemctl status ferm-early
[sudo] Mot de passe de prahal :
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 2min
21s ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Process: 2072 ExecStart=/usr/libexec/ferm/ferm-systemd
activate_early (code=exited, status=0/SUCCESS)
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
prahal ~ sudo systemctl status ferm
× ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
Active: failed (Result: exit-code) since Sat 2026-08-15 04:13:52
CEST; 2min 16s ago
Invocation: 8755fafd7aff4c03966f34de2b382782
Docs: man:ferm(1)
Process: 2876 ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early
(code=exited, status=0/SUCCESS)
Process: 2891 ExecStart=/usr/libexec/ferm/ferm-systemd activate
(code=exited, status=1/FAILURE)
Main PID: 2891 (code=exited, status=1/FAILURE)
Mem peak: 9.3M
CPU: 183ms
août 15 04:13:52 hermes ferm-systemd[2891]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:13:52 hermes ferm-systemd[2956]: iptables-restore v1.8.13
(nf_tables): Chain 'FORWARD-early' does not exist
août 15 04:13:52 hermes ferm-systemd[2956]: Error occurred at line: 102
août 15 04:13:52 hermes ferm-systemd[2956]: Try `iptables-restore -h'
or 'iptables-restore --help' for more information.
août 15 04:13:52 hermes ferm-systemd[2903]: Failed to run
/usr/sbin/iptables-restore
août 15 04:13:52 hermes ferm-systemd[2903]: Firewall rules rolled back.
prahal ~ 3 ls -l /etc/alternatives/iptables*
lrwxrwxrwx 1 root root 22 15 août 03:49 /etc/alternatives/iptables
-> /usr/sbin/iptables-nft
lrwxrwxrwx 1 root root 30 15 août 03:49
/etc/alternatives/iptables-restore -> /usr/sbin/iptables-nft-restore
lrwxrwxrwx 1 root root 27 15 août 03:49
/etc/alternatives/iptables-save -> /usr/sbin/iptables-nft-save
prahal ~ ls -l /etc/alternatives/ip6tables*
lrwxrwxrwx 1 root root 23 15 août 04:09 /etc/alternatives/ip6tables
-> /usr/sbin/ip6tables-nft
lrwxrwxrwx 1 root root 31 15 août 04:09
/etc/alternatives/ip6tables-restore -> /usr/sbin/ip6tables-nft-restore
lrwxrwxrwx 1 root root 28 15 août 04:09
/etc/alternatives/ip6tables-save -> /usr/sbin/ip6tables-nft-save
^
the alternatives links are above
mind I had iptables set to iptables-legacy beforehand, I switched to
iptables-nft while debugging this issue.
Note I don't have a vanilly Debian ferm setup but a debops one (ie
/etc/ferm/ferm.conf is not Debian vanilla). But it
seems unrelated to current issue.
Can you reproduce this with a Debian vanilla ferm.conf? If not, can
you show the configuration that fails?
What is your /etc/alternatives/iptables* pointing to? Can you
reproduce the issues by emptying out all tables and manually going
through the same motions that the ferm-early and the ferm services do?
Especially, what rules does ferm-early install?
I doubt my /etc/ferm/ferm.conf is the issue, here it is:
"
cat /etc/ferm/ferm.conf
# Ansible managed
# Load configuration from parts
@include 'rules.d/';
"
my ferm-early.service and ferm.service are vanilla Debian but I cannot
reproduce by starting by hand instead of during the boot
"
sudo iptables -F
prahal ~ sudo iptables -X
prahal ~ sudo systemctl start ferm-early
prahal ~ sudo systemctl start ferm
prahal ~ sudo systemctl status ferm
● ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago
Invocation: 74cdbf8e52ca45468d95bf505d1067d8
Docs: man:ferm(1)
Main PID: 11194 (code=exited, status=0/SUCCESS)
Mem peak: 9.5M
CPU: 142ms
août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall rules:
/usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules activated
successfully
prahal ~ sudo systemctl status ferm-early
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules:
/usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
same with removing the /run/ferm/inhibit-early file beforehand:
sudo rm /run/ferm/inhibit-early
prahal ~ sudo iptables -F
prahal ~ sudo iptables -X
prahal ~ sudo systemctl start ferm-early
prahal ~ sudo systemctl cat ferm
# /usr/lib/systemd/system/ferm.service
[Unit]
Description=Firewall configuration with ferm
Documentation=man:ferm(1)
After=network-online.target nss-lookup.target
Wants=network-online.target
ConditionFileIsExecutable=/usr/sbin/ferm
ConditionPathExists=/etc/ferm/ferm.conf
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/default/ferm
# Set defaults for variables not in environment file
# (EnvironmentFile takes precedence, see systemd.exec(5)
Environment="CACHE=no"
Environment="OPTIONS="
# Execute wrapper
ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early
ExecStart=/usr/libexec/ferm/ferm-systemd activate
ExecReload=/usr/libexec/ferm/ferm-systemd activate
ExecStop=/usr/libexec/ferm/ferm-systemd deactivate
UMask=0077
# Security hardening
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/cache/ferm /run
NoNewPrivileges=no
# Required capabilities for firewall management
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_MODULE
[Install]
WantedBy=multi-user.target
prahal ~ sudo systemctl start ferm
prahal ~ sudo systemctl status ferm-early
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules:
/usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
prahal ~ sudo systemctl status ferm
● ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago
Invocation: 74cdbf8e52ca45468d95bf505d1067d8
Docs: man:ferm(1)
Main PID: 11194 (code=exited, status=0/SUCCESS)
Mem peak: 9.5M
CPU: 142ms
août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall rules:
/usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules activated
successfully
"
Best Regards
Alban
