From: Alban Browaeys <[email protected]>
Subject: Re: Bug#1144431: ferm: seems ferm early prevents ferm from starting
To: Marc Haber <[email protected]>, Alban Browaeys
<[email protected]>, [email protected]
Date: Sat, 15 Aug 2026 12:10:20 +0200
User-Agent: Mozilla Thunderbird
X-Spam-Score: (--) -2.1
X-Spam-Report: torres.zugschlus.de Content analysis details: (-2.1
points, 5.0 required) pts rule name description ----
---------------------- ------------------------------------------- 0.0
SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0
RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[2a00:1450:4864:20:0:0:0:334 listed in]
[list.dnswl.org] -0.0 SPF_PASS
SPF: sender matches SPF record 0.1 DKIM_SIGNED
Message has a DKIM or DK signature, not necessarily valid -0.1
DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain -0.1 DKIM_VALID_EF
Message has a valid DKIM or DK signature from
envelope-from domain -0.1 DKIM_VALID
Message has at least one valid DKIM or DK signature -1.9
BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000] 0.0 FREEMAIL_FROM
Sender email is commonly abused enduser mail provider
[alban.browaeys(at)gmail.com]
Le 15/08/2026 à 09:55, Marc Haber a écrit :
Hi,
On Sat, Aug 15, 2026 at 04:20:58AM +0200, Alban Browaeys wrote:
sudo systemctl status ferm-early
[sudo] Mot de passe de prahal :
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST;
2min 21s ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Process: 2072 ExecStart=/usr/libexec/ferm/ferm-systemd
activate_early (code=exited, status=0/SUCCESS)
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
prahal ~ sudo systemctl status ferm
× ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service;
enabled; preset: enabled)
Active: failed (Result: exit-code) since Sat 2026-08-15
04:13:52 CEST; 2min 16s ago
Invocation: 8755fafd7aff4c03966f34de2b382782
Docs: man:ferm(1)
Process: 2876 ExecStartPre=/usr/bin/touch
/run/ferm/inhibit-early (code=exited, status=0/SUCCESS)
Process: 2891 ExecStart=/usr/libexec/ferm/ferm-systemd
activate (code=exited, status=1/FAILURE)
Main PID: 2891 (code=exited, status=1/FAILURE)
Mem peak: 9.3M
CPU: 183ms
août 15 04:13:52 hermes ferm-systemd[2891]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:13:52 hermes ferm-systemd[2956]: iptables-restore
v1.8.13 (nf_tables): Chain 'FORWARD-early' does not exist
août 15 04:13:52 hermes ferm-systemd[2956]: Error occurred at line: 102
août 15 04:13:52 hermes ferm-systemd[2956]: Try
`iptables-restore -h' or 'iptables-restore --help' for more
information.
août 15 04:13:52 hermes ferm-systemd[2903]: Failed to run
/usr/sbin/iptables-restore
août 15 04:13:52 hermes ferm-systemd[2903]: Firewall rules rolled back.
prahal ~ 3 ls -l /etc/alternatives/iptables*
lrwxrwxrwx 1 root root 22 15 août 03:49
/etc/alternatives/iptables -> /usr/sbin/iptables-nft
lrwxrwxrwx 1 root root 30 15 août 03:49
/etc/alternatives/iptables-restore ->
/usr/sbin/iptables-nft-restore
lrwxrwxrwx 1 root root 27 15 août 03:49
/etc/alternatives/iptables-save -> /usr/sbin/iptables-nft-save
prahal ~ ls -l /etc/alternatives/ip6tables*
lrwxrwxrwx 1 root root 23 15 août 04:09
/etc/alternatives/ip6tables -> /usr/sbin/ip6tables-nft
lrwxrwxrwx 1 root root 31 15 août 04:09
/etc/alternatives/ip6tables-restore ->
/usr/sbin/ip6tables-nft-restore
lrwxrwxrwx 1 root root 28 15 août 04:09
/etc/alternatives/ip6tables-save -> /usr/sbin/ip6tables-nft-save
^
the alternatives links are above
mind I had iptables set to iptables-legacy beforehand, I switched to
iptables-nft while debugging this issue.
Note I don't have a vanilly Debian ferm setup but a debops one (ie
/etc/ferm/ferm.conf is not Debian vanilla). But it
seems unrelated to current issue.
Can you reproduce this with a Debian vanilla ferm.conf? If not,
can you show the configuration that fails?
What is your /etc/alternatives/iptables* pointing to? Can you
reproduce the issues by emptying out all tables and manually going
through the same motions that the ferm-early and the ferm services
do? Especially, what rules does ferm-early install?
I doubt my /etc/ferm/ferm.conf is the issue, here it is:
"
cat /etc/ferm/ferm.conf
# Ansible managed
# Load configuration from parts
@include 'rules.d/';
"
my ferm-early.service and ferm.service are vanilla Debian but I
cannot reproduce by starting by hand instead of during the boot
"
sudo iptables -F
prahal ~ sudo iptables -X
prahal ~ sudo systemctl start ferm-early
prahal ~ sudo systemctl start ferm
prahal ~ sudo systemctl status ferm
● ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago
Invocation: 74cdbf8e52ca45468d95bf505d1067d8
Docs: man:ferm(1)
Main PID: 11194 (code=exited, status=0/SUCCESS)
Mem peak: 9.5M
CPU: 142ms
août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules
activated successfully
prahal ~ sudo systemctl status ferm-early
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
same with removing the /run/ferm/inhibit-early file beforehand:
sudo rm /run/ferm/inhibit-early
prahal ~ sudo iptables -F
prahal ~ sudo iptables -X
prahal ~ sudo systemctl start ferm-early
prahal ~ sudo systemctl cat ferm
# /usr/lib/systemd/system/ferm.service
[Unit]
Description=Firewall configuration with ferm
Documentation=man:ferm(1)
After=network-online.target nss-lookup.target
Wants=network-online.target
ConditionFileIsExecutable=/usr/sbin/ferm
ConditionPathExists=/etc/ferm/ferm.conf
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/default/ferm
# Set defaults for variables not in environment file
# (EnvironmentFile takes precedence, see systemd.exec(5)
Environment="CACHE=no"
Environment="OPTIONS="
# Execute wrapper
ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early
ExecStart=/usr/libexec/ferm/ferm-systemd activate
ExecReload=/usr/libexec/ferm/ferm-systemd activate
ExecStop=/usr/libexec/ferm/ferm-systemd deactivate
UMask=0077
# Security hardening
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/cache/ferm /run
NoNewPrivileges=no
# Required capabilities for firewall management
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_MODULE
[Install]
WantedBy=multi-user.target
prahal ~ sudo systemctl start ferm
prahal ~ sudo systemctl status ferm-early
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
prahal ~ sudo systemctl status ferm
● ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago
Invocation: 74cdbf8e52ca45468d95bf505d1067d8
Docs: man:ferm(1)
Main PID: 11194 (code=exited, status=0/SUCCESS)
Mem peak: 9.5M
CPU: 142ms
août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall
rules: /usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules
activated successfully
"
Best Regards
Alban
