Hi.

In the recent version you added information to README.Debian about
handling fail2ban with systemd and firewall packages (shorewall in
particular).

Coudln't this be solved generically and enabled per default?

I.e.:
- not requiring the admin to make the override manually (but ship it)
- set the necessary unit settings for not just shorewall?
  A solution could be (I guess) to set Wants/After for the known firewall
  packages like shorewall or netfilter-persistence/iptables-persistence

  A more generic solution could be to use networking-pre.target, wich is
  AFAIU meant to be used by such firewall packages.
  But if you choose that, better ask the systemd maintainers in Debian.
  I'm not sure how far this works already,... and I guess most firewall
  packages don't themselve set the necessary Unit-settings so that
  networking-pre.target, depends on them (reversely).


Cheers,
Chris.

Hello

just to add a piece of information

Since version 1.0.13 netfilter-persistent (aka iptables-persistent)
provides 2 dummy services, iptables.service and ip6tables.service

Both of them are managed as alternatives so other firewall managers can
provide them; fail2ban could `Require` and `After` to this virtual
services instead of list them all in the override.

On the other hand, you could list them all in the service file, systemd
will ignore the inexistant services.


thanks for fail2ban :)