#1101769 fail2ban: Fail2ban does not work out of the box when nftables is installed

Package:
fail2ban
Source:
fail2ban
Submitter:
Clement ARTHAUD-BERTHET
Date:
2025-03-31 19:18:02 UTC
Severity:
normal
#1101769#5
Date:
2025-03-31 19:14:44 UTC
From:
To:
Fail2ban does not work out of the box when nftables is installed.

Problem:
- Fail2ban can work with either iptables or nftables.
- On a system where nftables is installed by default, iptables is not present.
- However, Fail2ban does not function properly with nftables unless the configuration is manually adjusted.
- As a result, the default installation of Fail2ban fails silently or does not apply any firewall rules.

Expected behavior:
- Either Fail2ban should depend on iptables,
- Or it should be properly configured to work with nftables by default.

Steps to reproduce:
1. Install Debian 12.10 "Bookworm"
2. Install fail2ban (without manually installing iptables)
3. Observe that fail2ban starts, but no IPs are banned and no rules are applied

Workaround:
- Manually configure Fail2ban to use the `nftables` action
- Or manually install iptables

System info:
- Debian version: 12.10
- Kernel: Linux 6.1.0-13-amd64