fail2ban that never banned anyone: '/bin/sh: 1: nft: not found'
fail2ban listed the address as banned, and the address still got in. On a Debian host with firewalld, the nft binary was missing, so every ban had failed.
·4 mins
Firewalld
2026
No DHCP for an LXC container while iptables counts the packets as ACCEPT: firewalld rejects them in its own nftables table
The iptables ACCEPT rule for udp/67 on lxcbr0 kept counting, and dnsmasq never saw a DHCPDISCOVER. With nftables, an accept is not final: firewalld's table hooks in after it and rejected everything from the bridge.
·5 mins