Dear Maintainer,
At boot ferm fails.
sudo systemctl status ferm-early
[sudo] Mot de passe de prahal :
● ferm-early.service - Early Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm-early.service; enabled; preset: enabled)
Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 2min 21s ago
Invocation: 0a3fb74a9c0749fdbbd990231f0aed49
Docs: man:ferm(1)
https://systemd.io/NETWORK_ONLINE/
Process: 2072 ExecStart=/usr/libexec/ferm/ferm-systemd activate_early (code=exited, status=0/SUCCESS)
Main PID: 2072 (code=exited, status=0/SUCCESS)
Mem peak: 10M
CPU: 123ms
août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf
août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules activated successfully
prahal ~ sudo systemctl status ferm
× ferm.service - Firewall configuration with ferm
Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Sat 2026-08-15 04:13:52 CEST; 2min 16s ago
Invocation: 8755fafd7aff4c03966f34de2b382782
Docs: man:ferm(1)
Process: 2876 ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early (code=exited, status=0/SUCCESS)
Process: 2891 ExecStart=/usr/libexec/ferm/ferm-systemd activate (code=exited, status=1/FAILURE)
Main PID: 2891 (code=exited, status=1/FAILURE)
Mem peak: 9.3M
CPU: 183ms
août 15 04:13:52 hermes ferm-systemd[2891]: Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm.conf
août 15 04:13:52 hermes ferm-systemd[2956]: iptables-restore v1.8.13 (nf_tables): Chain 'FORWARD-early' does not exist
août 15 04:13:52 hermes ferm-systemd[2956]: Error occurred at line: 102
août 15 04:13:52 hermes ferm-systemd[2956]: Try `iptables-restore -h' or 'iptables-restore --help' for more information.
août 15 04:13:52 hermes ferm-systemd[2903]: Failed to run /usr/sbin/iptables-restore
août 15 04:13:52 hermes ferm-systemd[2903]: Firewall rules rolled back.
prahal ~ 3 ls -l /etc/alternatives/iptables*
lrwxrwxrwx 1 root root 22 15 août 03:49 /etc/alternatives/iptables -> /usr/sbin/iptables-nft
lrwxrwxrwx 1 root root 30 15 août 03:49 /etc/alternatives/iptables-restore -> /usr/sbin/iptables-nft-restore
lrwxrwxrwx 1 root root 27 15 août 03:49 /etc/alternatives/iptables-save -> /usr/sbin/iptables-nft-save
prahal ~ ls -l /etc/alternatives/ip6tables*
lrwxrwxrwx 1 root root 23 15 août 04:09 /etc/alternatives/ip6tables -> /usr/sbin/ip6tables-nft
lrwxrwxrwx 1 root root 31 15 août 04:09 /etc/alternatives/ip6tables-restore -> /usr/sbin/ip6tables-nft-restore
lrwxrwxrwx 1 root root 28 15 août 04:09 /etc/alternatives/ip6tables-save -> /usr/sbin/ip6tables-nft-save
Note I don't have a vanilly Debian ferm setup but a debops one (ie
/etc/ferm/ferm.conf is not Debian vanilla). But it
seems unrelated to current issue.
Best Regards,
Alban
Hi, Can you reproduce this with a Debian vanilla ferm.conf? If not, can you show the configuration that fails? What is your /etc/alternatives/iptables* pointing to? Can you reproduce the issues by emptying out all tables and manually going through the same motions that the ferm-early and the ferm services do? Especially, what rules does ferm-early install? Greetings Marc
Le 15/08/2026 à 09:55, Marc Haber a écrit : ^ the alternatives links are above mind I had iptables set to iptables-legacy beforehand, I switched to iptables-nft while debugging this issue. I doubt my /etc/ferm/ferm.conf is the issue, here it is: " cat /etc/ferm/ferm.conf # Ansible managed # Load configuration from parts @include 'rules.d/'; " my ferm-early.service and ferm.service are vanilla Debian but I cannot reproduce by starting by hand instead of during the boot " sudo iptables -F prahal ~ sudo iptables -X prahal ~ sudo systemctl start ferm-early prahal ~ sudo systemctl start ferm prahal ~ sudo systemctl status ferm ● ferm.service - Firewall configuration with ferm Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled; preset: enabled) Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago Invocation: 74cdbf8e52ca45468d95bf505d1067d8 Docs: man:ferm(1) Main PID: 11194 (code=exited, status=0/SUCCESS) Mem peak: 9.5M CPU: 142ms août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm.conf août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules activated successfully prahal ~ sudo systemctl status ferm-early ● ferm-early.service - Early Firewall configuration with ferm Loaded: loaded (/usr/lib/systemd/system/ferm-early.service; enabled; preset: enabled) Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago Invocation: 0a3fb74a9c0749fdbbd990231f0aed49 Docs: man:ferm(1) https://systemd.io/NETWORK_ONLINE/ Main PID: 2072 (code=exited, status=0/SUCCESS) Mem peak: 10M CPU: 123ms août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules activated successfully same with removing the /run/ferm/inhibit-early file beforehand: sudo rm /run/ferm/inhibit-early prahal ~ sudo iptables -F prahal ~ sudo iptables -X prahal ~ sudo systemctl start ferm-early prahal ~ sudo systemctl cat ferm # /usr/lib/systemd/system/ferm.service [Unit] Description=Firewall configuration with ferm Documentation=man:ferm(1) After=network-online.target nss-lookup.target Wants=network-online.target ConditionFileIsExecutable=/usr/sbin/ferm ConditionPathExists=/etc/ferm/ferm.conf [Service] Type=oneshot RemainAfterExit=yes EnvironmentFile=-/etc/default/ferm # Set defaults for variables not in environment file # (EnvironmentFile takes precedence, see systemd.exec(5) Environment="CACHE=no" Environment="OPTIONS=" # Execute wrapper ExecStartPre=/usr/bin/touch /run/ferm/inhibit-early ExecStart=/usr/libexec/ferm/ferm-systemd activate ExecReload=/usr/libexec/ferm/ferm-systemd activate ExecStop=/usr/libexec/ferm/ferm-systemd deactivate UMask=0077 # Security hardening PrivateTmp=yes ProtectSystem=strict ProtectHome=yes ReadWritePaths=/var/cache/ferm /run NoNewPrivileges=no # Required capabilities for firewall management AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_MODULE [Install] WantedBy=multi-user.target prahal ~ sudo systemctl start ferm prahal ~ sudo systemctl status ferm-early ● ferm-early.service - Early Firewall configuration with ferm Loaded: loaded (/usr/lib/systemd/system/ferm-early.service; enabled; preset: enabled) Active: active (exited) since Sat 2026-08-15 04:13:44 CEST; 7h ago Invocation: 0a3fb74a9c0749fdbbd990231f0aed49 Docs: man:ferm(1) https://systemd.io/NETWORK_ONLINE/ Main PID: 2072 (code=exited, status=0/SUCCESS) Mem peak: 10M CPU: 123ms août 15 04:13:43 hermes ferm-systemd[2072]: Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm-early.conf août 15 04:13:44 hermes ferm-systemd[2072]: Early Firewall rules activated successfully prahal ~ sudo systemctl status ferm ● ferm.service - Firewall configuration with ferm Loaded: loaded (/usr/lib/systemd/system/ferm.service; enabled; preset: enabled) Active: active (exited) since Sat 2026-08-15 04:27:19 CEST; 7h ago Invocation: 74cdbf8e52ca45468d95bf505d1067d8 Docs: man:ferm(1) Main PID: 11194 (code=exited, status=0/SUCCESS) Mem peak: 9.5M CPU: 142ms août 15 04:27:19 hermes ferm-systemd[11194]: Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm.conf août 15 04:27:19 hermes ferm-systemd[11194]: Firewall rules activated successfully " Best Regards Alban
Hi Alban, thanks for giving this helpful information. I won't have time to look into this until somewhen next week though. Do you have a workaround in place that still allows you to work or do you need something quicker? Greetings Marc
Le 15/08/2026 à 13:45, Marc Haber a écrit : Well ... my main issue with this ferm breakage is that I cannot connect to gnome shell via RDP without cleaning iptables and restarting ferm manually.... but yesterday I discovered that with current Debian testing, gnome-shell crashes when I connect to it via RDP... so for now this ferm issue is hidden behind a more critical one. But I preferred to report it sooner. But my current workaround is to ssh to the box, iptables -F, iptables -X, sudo systemctl restart ferm. Could well be the issue is local to this box, ie a leftover corrupt iptables state file or such, but I don't know iptables/nft save/restore well enough. Best Regards, Alban
Hi Alban, I have uploaded a new version of ferm to unstable that allows the ferm-systemd script to save more debug information. Can you try this please, and if it still fails (which is likely), set DEBUGLOG_DIR to a directory that is read-write available early and survives the system startup (like /var/cache/ferm, for example). Then feel free to send me a tarball. Greetings Marc
I seem to have a clue at what's wrong with AI help.
I use Debops which preserves a set of previous RULES (for one FORWARD
rules) but this preserves the jump to FORWARD-early even though
FORWARD-early itself is not defined in my ferm rules set.
This preserves is mainly there to keep docker rules on restart and such.
Debian default /etc/ferm/ferm.conf is not affected because it empties
the FORWARD rule. But thus it purges docker rules on restart I believe.
I managed to workaround this with
"
cat /etc/ferm/rules.d/000_rule_reset_ferm_early.conf
domain (ip ip6) {
table filter {
chain INPUT-early {}
chain OUTPUT-early {}
chain FORWARD-early {}
}
}
" and "
cat /etc/ferm/rules.d/000_rule_purge_ferm_early_hooks.conf
@hook post "iptables -D INPUT -j INPUT-early 2>/dev/null || true";
@hook post "iptables -D OUPUT -j OUTPUT-early 2>/dev/null || true";
@hook post "iptables -D FORWARD -j FORWARD-early 2>/dev/null || true";
@hook post "iptables -X INPUT-early 2>/dev/null || true";
@hook post "iptables -X OUTPUT-early 2>/dev/null || true";
@hook post "iptables -X FORWARD-early 2>/dev/null || true";
@hook post "ip6tables -D INPUT -j INPUT-early 2>/dev/null || true";
@hook post "ip6tables -D OUPUT -j OUTPUT-early 2>/dev/null || true";
@hook post "ip6tables -D FORWARD -j FORWARD-early 2>/dev/null || true";
@hook post "ip6tables -X INPUT-early 2>/dev/null || true";
@hook post "ip6tables -X OUTPUT-early 2>/dev/null || true";
@hook post "ip6tables -X FORWARD-early 2>/dev/null || true";
"
but this looks like porcelain. Everytime /etc/ferm/ferm-early.conf is
modified this will requires changes.
But I cannot flush the FORWARD ruleset either because I cannot expect a
predefined set of docker rules to add to it afterwards either (not to
account that this script should account for when docker is not use too).
Regards
Alban
"
sudo /usr/libexec/ferm/ferm-systemd activate
Activating firewall rules: /usr/sbin/ferm /etc/ferm/ferm.conf
iptables-restore v1.8.13 (legacy): Couldn't load target
`FORWARD-early':No such file or directory
Error occurred at line: 38
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Failed to run /usr/sbin/iptables-restore
Firewall rules rolled back.
"
"
sudo iptables -L -n -v
Chain INPUT (policy DROP 22 packets, 8224 bytes)
pkts bytes target prot opt in out source destination
58 14649 INPUT-early all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-FORWARD all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 FORWARD-early all -- * * 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy ACCEPT 13 packets, 16647 bytes)
pkts bytes target prot opt in out source destination
50 22762 OUTPUT-early all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- !br-27afa3a73960 br-27afa3a73960
0.0.0.0/0 172.18.0.2 tcp dpt:9443
0 0 ACCEPT tcp -- !br-27afa3a73960 br-27afa3a73960
0.0.0.0/0 172.18.0.2 tcp dpt:9000
0 0 ACCEPT tcp -- !br-27afa3a73960 br-27afa3a73960
0.0.0.0/0 172.18.0.2 tcp dpt:8000
0 0 DROP all -- !br-27afa3a73960 br-27afa3a73960
0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-BRIDGE (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * br-27afa3a73960 0.0.0.0/0
0.0.0.0/0
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-CT (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * br-27afa3a73960 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
Chain DOCKER-FORWARD (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-CT all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 DOCKER-BRIDGE all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- br-27afa3a73960 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- docker0 * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all -- br-27afa3a73960
!br-27afa3a73960 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0
0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * br-27afa3a73960 0.0.0.0/0
0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
Chain FORWARD-early (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
Chain INPUT-early (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- lo * 0.0.0.0/0 0.0.0.0/0
udp spt:54321
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID
36 6425 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpt:500
0 0 ACCEPT esp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT ah -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22
Chain OUTPUT-early (1 references)
pkts bytes target prot opt in out source destination
37 6115 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
"
"
cat /etc/ferm/ferm.conf
# Ansible managed
# Load configuration from parts
@include 'rules.d/';
"
"
for i in /etc/ferm/rules.d/* ; do echo $i; cat $i; echo "";done
/etc/ferm/rules.d/000_rule_docker_preserve.conf
# Ansible managed
# # Docker support.
# # cf
https://github.com/MaxKellermann/ferm/issues/58#issuecomment-588600252
table nat chain (PREROUTING OUTPUT POSTROUTING DOCKER) @preserve;
table filter chain (FORWARD DOCKER DOCKER-ISOLATION-STAGE-1
DOCKER-ISOLATION-STAGE-2 DOCKER-FORWARD DOCKER-CT DOCKER-BRIDGE) @preserve;
table filter chain (DOCKER-USER) { RETURN; }
/etc/ferm/rules.d/000_rule_firewall_hooks.conf
# Ansible managed
# Run custom hooks at various firewall stages
@hook pre "run-parts /etc/ferm/hooks/pre.d";
@hook post "run-parts /etc/ferm/hooks/post.d";
@hook flush "run-parts /etc/ferm/hooks/flush.d";
/etc/ferm/rules.d/000_rule_firewall_log.conf
# Ansible managed
# Custom log function used by other rules
@def &log($msg) = {
mod limit limit 2/min
limit-burst 5
LOG log-ip-options log-prefix "$msg";
}
/etc/ferm/rules.d/000_rule_firewall_variables.conf
# Ansible managed
# Define custom variables available in the firewall
@def $domains = (ip ip6);
@def $ipv4_enabled = 1;
@def $ipv6_enabled = 1;
/etc/ferm/rules.d/001_rule_accept_loopback.conf
# Ansible managed
domain (ip ip6) table filter chain INPUT {
interface lo {
ACCEPT;
}
}
/etc/ferm/rules.d/005_rule_accept_ansible_controller.conf
# Ansible managed
# Accept SSH connections from Ansible Controllers
domain (ip ip6) table filter chain INPUT {
protocol tcp dport ssh {
# Connections from any IP address not allowed
}
}
/etc/ferm/rules.d/005_rule_policy_filter_forward.conf
# Ansible managed
domain (ip ip6) table filter chain FORWARD {
policy DROP;
}
/etc/ferm/rules.d/005_rule_policy_filter_input.conf
# Ansible managed
domain (ip ip6) table filter chain INPUT {
policy DROP;
}
/etc/ferm/rules.d/005_rule_policy_filter_output.conf
# Ansible managed
domain (ip ip6) table filter chain OUTPUT {
policy ACCEPT;
}
(...)
"
On Sat, 29 Aug 2026 15:29:23 +0200 Marc Haber
<mh+debian-packages@zugschlus.de> wrote:
> Hi Alban,
>
> I have uploaded a new version of ferm to unstable that allows the
> ferm-systemd script to save more debug information. Can you try this
> please, and if it still fails (which is likely), set DEBUGLOG_DIR to a
> directory that is read-write available early and survives the system
> startup (like /var/cache/ferm, for example). Then feel free to send me a
> tarball.
>
> Greetings
> Marc
>
> On Sat, Aug 15, 2026 at 01:45:52PM +0200, Marc Haber wrote:
> >From: Marc Haber <mh+debian-packages@zugschlus.de>
> >Subject: Bug#1144431: ferm: seems ferm early prevents ferm from starting
> >To: Alban Browaeys <alban.browaeys@gmail.com>
> >Cc: Alban Browaeys <prahal@yahoo.com>, 1144431@bugs.debian.org
> >Reply-To: Marc Haber <mh+debian-packages@zugschlus.de>,
> > 1144431@bugs.debian.org
> >Date: Sat, 15 Aug 2026 13:45:52 +0200
> >X-Debian-PR-Package: ferm
> >User-Agent: Mutt/2.2.13 (2024-03-09)
> >List-Id: <ferm.tracker.debian.org>
> >X-PTS-Package: ferm
> >X-Spam-Score: (----) -4.5
> >X-Spam-Report: torres.zugschlus.de Content analysis details: (-4.5
> > points, 5.0 required) pts rule name description ----
> > ---------------------- ------------------------------------------- -2.3
> > RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/,
> > medium trust
> > [2001:648:2ffc:deb:216:61ff:fe9d:958d listed
> > in] [list.dnswl.org] -0.0 SPF_PASS
> > SPF: sender matches SPF record -0.0 SPF_HELO_PASS
> > SPF: HELO matches SPF record -1.9 BAYES_00 BODY:
> > Bayes spam probability is 0 to 1% [score:
> > 0.0000] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd
level
> > mail domains are different -0.5
> > MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
> > manager
> >
> >Hi Alban,
> >
> >thanks for giving this helpful information. I won't have time to look
> >into this until somewhen next week though. Do you have a workaround in
> >place that still allows you to work or do you need something quicker?
> >
> >Greetings
> >Marc
> >
> >On Sat, Aug 15, 2026 at 12:10:20PM +0200, Alban Browaeys wrote:
> >>From: Alban Browaeys <alban.browaeys@gmail.com>
> >>Subject: Re: Bug#1144431: ferm: seems ferm early prevents ferm from
starting
> >>To: Marc Haber <mh+debian-bugs@zugschlus.de>, Alban Browaeys
> >><prahal@yahoo.com>, 1144431@bugs.debian.org
> >>Date: Sat, 15 Aug 2026 12:10:20 +0200
> >>User-Agent: Mozilla Thunderbird
> >>X-Spam-Score: (--) -2.1
> >>X-Spam-Report: torres.zugschlus.de Content analysis details: (-2.1
> >>points, 5.0 required) pts rule name description ----
> >>---------------------- ------------------------------------------- 0.0
Hi Alban, Can you try start order so that docker networking doesn't start before ferm is finished? If that needs cooperation from the ferm systemd units, you can try that with an override and then submit the requeste changes, I'll include them when it is feasible. Either you can interlock docker with ferm the same way as ferm-early is interlocked with ferm, or ferm could write a marker file when it's finished. ferm should be as compatible as possble with things like docker and libvirt as those software packages are the common cause for not migrating to nft. Once the system startup issue was solved, the next challenge will be what happens with the docker chains and the rules that invoke them when you rebuild ferm's rules. Would you mind me downgrading this bug to normal and retitling it to something along "startup order issues with ferm and docker"? Greetings Marc
Le 12 septembre 2026 10:06:12 GMT+02:00, Marc Haber <mh+debian-packages@zugschlus.de> a écrit : Done via control headers in this email. I title it to convey that the issue is only with newer kernels being more strict, but maybe I should have written what you suggested that is to tell that the issue is with preserving docker rules. By the way I believe you have the same issue that the Debops ferm rules try to fix that is preserve docker rules on restart/reload. Thanks Alban