Dear Maintainer,

At boot ferm fails.
sudo systemctl status ferm-early
[sudo] Mot de passe de prahal :
● ferm-early.service - Early Firewall configuration with ferm
     Loaded: loaded (/usr/lib/systemd/system/ferm-early.service; enabled; preset: enabled)
     Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 2min 21s ago
 Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
       Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
    Process: 2072 ExecStart=/usr/libexec/ferm/ferm-systemd activate_early (code=exited, status=0/SUCCESS)
   Main PID: 2072 (code=exited, status=0/SUCCESS)
   Mem peak: 10M
        CPU: 123ms

août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules: /usr/sbin/ferm   /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules activated successfully
 prahal  ~  sudo systemctl status ferm
× ferm.service - Firewall configuration with ferm
     Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Sat 2026-08-15 04:13:52 CEST; 2min 16s ago
 Invocation: 8755fafd7aff4c03966f34de2b382782
       Docs: man:ferm(1)
    Process: 2876 ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early (code=exited, status=0/SUCCESS)
    Process: 2891 ExecStart=/usr/libexec/ferm/ferm-systemd activate (code=exited, status=1/FAILURE)
   Main PID: 2891 (code=exited, status=1/FAILURE)
   Mem peak: 9.3M
        CPU: 183ms

août 15 04:13:52 hermes ferm-systemd[2891]: Activating firewall rules: /usr/sbin/ferm   /etc/ferm/ferm.conf
août 15 04:13:52 hermes ferm-systemd[2956]: iptables-restore v1.8.13 (nf_tables): Chain 'FORWARD-early' does not exist
août 15 04:13:52 hermes ferm-systemd[2956]: Error occurred at line: 102
août 15 04:13:52 hermes ferm-systemd[2956]: Try `iptables-restore -h' or 'iptables-restore --help' for more information.
août 15 04:13:52 hermes ferm-systemd[2903]: Failed to run /usr/sbin/iptables-restore
août 15 04:13:52 hermes ferm-systemd[2903]: Firewall rules rolled back.
 prahal  ~  3  ls -l /etc/alternatives/iptables*
lrwxrwxrwx 1 root root 22 15 août  03:49 /etc/alternatives/iptables -> /usr/sbin/iptables-nft
lrwxrwxrwx 1 root root 30 15 août  03:49 /etc/alternatives/iptables-restore -> /usr/sbin/iptables-nft-restore
lrwxrwxrwx 1 root root 27 15 août  03:49 /etc/alternatives/iptables-save -> /usr/sbin/iptables-nft-save
 prahal  ~  ls -l /etc/alternatives/ip6tables*
lrwxrwxrwx 1 root root 23 15 août  04:09 /etc/alternatives/ip6tables -> /usr/sbin/ip6tables-nft
lrwxrwxrwx 1 root root 31 15 août  04:09 /etc/alternatives/ip6tables-restore -> /usr/sbin/ip6tables-nft-restore
lrwxrwxrwx 1 root root 28 15 août  04:09 /etc/alternatives/ip6tables-save -> /usr/sbin/ip6tables-nft-save

Note I don't have a vanilly Debian ferm setup but a debops one (ie
/etc/ferm/ferm.conf is not Debian vanilla). But it
seems unrelated to current issue.

Best Regards,
Alban

Hi,

Can you reproduce this with a Debian vanilla ferm.conf? If not, can you
show the configuration that fails?

What is your /etc/alternatives/iptables* pointing to? Can you reproduce
the issues by emptying out all tables and manually going through the
same motions that the ferm-early and the ferm services do? Especially,
what rules does ferm-early install?

Greetings
Marc

Le 15/08/2026 à 09:55, Marc Haber a écrit :
^

  the alternatives links are above


mind I had iptables set to iptables-legacy beforehand, I switched to
iptables-nft while debugging this issue.

I doubt my /etc/ferm/ferm.conf is the issue, here it is:

"

  cat /etc/ferm/ferm.conf
# Ansible managed

# Load configuration from parts
@include 'rules.d/';
"

my ferm-early.service and ferm.service are vanilla Debian but I cannot
reproduce by starting by hand instead of during the boot

"

sudo iptables -F
  prahal  ~  sudo iptables -X
  prahal  ~  sudo systemctl start ferm-early
  prahal  ~  sudo systemctl start ferm
  prahal  ~  sudo systemctl status ferm
● ferm.service - Firewall configuration with ferm
      Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
      Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago
  Invocation: 74cdbf8e52ca45468d95bf505d1067d8
        Docs: man:ferm(1)
    Main PID: 11194 (code=exited, status=0/SUCCESS)
    Mem peak: 9.5M
         CPU: 142ms

août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall rules:
/usr/sbin/ferm   /etc/ferm/ferm.conf
août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules activated
successfully
  prahal  ~  sudo systemctl status ferm-early
● ferm-early.service - Early Firewall configuration with ferm
      Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
      Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago
  Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
        Docs: man:ferm(1)
              https://systemd.io/NETWORK_ONLINE/
    Main PID: 2072 (code=exited, status=0/SUCCESS)
    Mem peak: 10M
         CPU: 123ms

août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules:
/usr/sbin/ferm   /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully


same with removing the /run/ferm/inhibit-early file beforehand:

sudo rm /run/ferm/inhibit-early
  prahal  ~  sudo iptables -F
  prahal  ~  sudo iptables -X
  prahal  ~  sudo systemctl start ferm-early
  prahal  ~  sudo systemctl cat ferm
# /usr/lib/systemd/system/ferm.service
[Unit]
Description=Firewall configuration with ferm
Documentation=man:ferm(1)
After=network-online.target nss-lookup.target
Wants=network-online.target
ConditionFileIsExecutable=/usr/sbin/ferm
ConditionPathExists=/etc/ferm/ferm.conf

[Service]
Type=oneshot
RemainAfterExit=yes

EnvironmentFile=-/etc/default/ferm

# Set defaults for variables not in environment file
# (EnvironmentFile takes precedence, see systemd.exec(5)
Environment="CACHE=no"
Environment="OPTIONS="

# Execute wrapper
ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early
ExecStart=/usr/libexec/ferm/ferm-systemd activate
ExecReload=/usr/libexec/ferm/ferm-systemd activate
ExecStop=/usr/libexec/ferm/ferm-systemd deactivate

UMask=0077

# Security hardening
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/cache/ferm /run
NoNewPrivileges=no

# Required capabilities for firewall management
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_MODULE

[Install]
WantedBy=multi-user.target
  prahal  ~  sudo systemctl start ferm
  prahal  ~  sudo systemctl status ferm-early
● ferm-early.service - Early Firewall configuration with ferm
      Loaded: loaded (/usr/lib/systemd/system/ferm-early.service;
enabled; preset: enabled)
      Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago
  Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
        Docs: man:ferm(1)
              https://systemd.io/NETWORK_ONLINE/
    Main PID: 2072 (code=exited, status=0/SUCCESS)
    Mem peak: 10M
         CPU: 123ms

août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules:
/usr/sbin/ferm   /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules
activated successfully
  prahal  ~  sudo systemctl status ferm
● ferm.service - Firewall configuration with ferm
      Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled;
preset: enabled)
      Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago
  Invocation: 74cdbf8e52ca45468d95bf505d1067d8
        Docs: man:ferm(1)
    Main PID: 11194 (code=exited, status=0/SUCCESS)
    Mem peak: 9.5M
         CPU: 142ms

août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall rules:
/usr/sbin/ferm   /etc/ferm/ferm.conf
août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules activated
successfully
"

Best Regards

Alban

Hi Alban,

thanks for giving this helpful information. I won't have time to look
into this until somewhen next week though. Do you have a workaround in
place that still allows you to work or do you need something quicker?

Greetings
Marc

Le 15/08/2026 à 13:45, Marc Haber a écrit :

Well ... my main issue with this ferm breakage is that I cannot connect
to gnome shell via RDP without cleaning iptables and restarting ferm
manually.... but yesterday I discovered that with current Debian
testing, gnome-shell crashes when I connect to it via RDP... so for now
this ferm issue is hidden behind a more critical one. But I preferred to
report it sooner.


But my current workaround is to ssh to the box, iptables -F, iptables
-X, sudo systemctl restart ferm.

Could well be the issue is local to this box, ie a leftover corrupt
iptables state file or such, but I don't know iptables/nft save/restore
well enough.


Best Regards,

Alban