[image] What happend to Virtualmin? Cant remove bind! cloud-init is not compatible with firewalld, and installing the latter will remove the former. Jebus, why would they do that!? I’m beginning to think firewalld is more trouble than it’s worth, though I don’t know what we’d replace it with.…

[image] Joe: Maybe we ought to get on nftables support in Webmin and switch to using it directly. FirewallD itself isn’t a problem. It would be a lot of work to implement nftables support as a separate module. Debian should fix it upstream.

BIG WISH FOR XMAS Remove Fail2ban and FireallD and use CSF Firewall! And pleae bring back logfiles… I cant get used to journalctl! Was where any change in the last years in these “new technology” (nftables vs iptables, logfiles vs. journal, systemd, and god knows what all else) that made is easie…

The Webmin/Virtualmin dev’s have to work what the OS providers present to them Yes some of the decisions of OS distributions might be questionable we have to live move forward with the OS tools that are current

[image] What happend to Virtualmin? Cant remove bind! Remove Fail2ban and FireallD and use CSF Firewall! Absolutely never going to happen. I don’t love Fail2ban or Firewalld, but CSF is not an upgrade. If we change, it will be to sshguard (probably) and maybe managing nftables directly. All t…

And, I guess I should say, I do kinda regret settling on both fail2ban and firewalld. They’re fine, but they’re not great. They’re also much heavier than I’d like, in terms of memory usage and in terms of how they approach the problems they solve. They introduce an extra layer of complexity that I’m…

At least firewalld is small: # ps aux |grep firewall root 700 0.0 0.0 317344 5452 ? Ssl Oct06 0:01 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid VIRT is a little big, but that doesn’t really matter. nftables by itself is smaller, though.

[image] Joe: Maybe we ought to get on nftables support in Webmin and switch to using it directly. Great idea, I would really appreciate that.

[quote=“Joe, post:6, topic:135964”] Anybody using fail2ban in ways you can’t use sshguard? Definition] failregex = timeout after AUTH from .*\[<HOST>\].* disconnect from .*\[<HOST>\].*auth=0/1 I have a few interesting filters like this.

Hmm…there is a regex parser available for sshguard, but I’ve never used it. And, the cost is high…a PCRE regex parser is going to effectively add a third of Perl to the memory usage and be quite a lot slower. And, it’s not in OS repos, AFAIK. I think we’d have to just say “use fail2ban instead” in …

From what little I know about sshguard it’s focused on blocking ssh attacks. Makes perfect sense on a non-VMin server where you may not have all the services online and being attacked. I only use the Webmin F2b module to stop/start/reload, check the jail status - for which it is very handy. I mig…

Virtualmin Community

Firewalld and cloud-init conflict on Debian 13

Virtualmin

Randomz December 7, 2025, 12:37am 13

Very true.

Debian 13 firewall and sshguard