{"record":{"id":"a7051e76d2a1e480","repo":"jdx/mise","slug":"no-supported-firewall-backend-found-tried-nft-fi","errorCode":null,"errorMessage":"no supported firewall backend found (tried nft, firewall-cmd, and ufw)","messagePattern":"no supported firewall backend found \\(tried nft, firewall-cmd, and ufw\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall.rs","lineNumber":986,"sourceCode":"        && backend_available(state.backend)\n    {\n        return Ok(state.backend);\n    }\n    for backend in [FirewallBackend::Firewalld, FirewallBackend::Ufw] {\n        if backend_available(backend) && backend_active(backend) {\n            return Ok(backend);\n        }\n    }\n    for backend in [\n        FirewallBackend::Nftables,\n        FirewallBackend::Firewalld,\n        FirewallBackend::Ufw,\n    ] {\n        if backend_available(backend) {\n            return Ok(backend);\n        }\n    }\n    bail!(\"no supported firewall backend found (tried nft, firewall-cmd, and ufw)\")\n}\n\nfn ensure_backend_available(backend: FirewallBackend) -> Result<()> {\n    if backend_available(backend) {\n        Ok(())\n    } else {\n        bail!(\n            \"firewall backend '{}' requires command '{}'\",\n            backend.label(),\n            backend.program().unwrap_or_default()\n        )\n    }\n}\n\nfn backend_available(backend: FirewallBackend) -> bool {\n    backend.program().and_then(crate::file::which).is_some()\n}\n","sourceCodeStart":968,"sourceCodeEnd":1004,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/firewall.rs#L968-L1004","documentation":"mise's firewall bootstrap needs a supported firewall backend to inspect and apply rules. It probes nft (nftables), firewall-cmd (firewalld), and ufw in that order; if none of the binaries is present or functional on the host it cannot manage the firewall and returns this error from detect_backend.","triggerScenarios":"Running any `mise bootstrap firewall ...` command on a host where neither nft, firewall-cmd, nor ufw is installed (or none is callable via PATH / backend_available fails), and no explicit backend was requested (or the requested one also failed ensure_backend_available).","commonSituations":"Minimal containers or VM images without any firewall userspace tools installed; macOS development machines; servers using only raw iptables-legacy; stripped-down CI environments.","solutions":["Install one of the supported backends: `apt install nftables` (or ufw / firewalld depending on your distro).","Ensure the tool is on PATH for the user running mise (check with `which nft firewall-cmd ufw`).","Explicitly pin a backend you know exists via the [firewall] config's backend setting.","If you do not want mise to manage the firewall at all, remove the [firewall] section from your config."],"exampleFix":"// before (Debian/Ubuntu host, no backend)\n$ mise bootstrap firewall status\nerror: no supported firewall backend found...\n\n// after\n$ sudo apt install nftables\n$ mise bootstrap firewall status","handlingStrategy":"validation","validationCode":"for tool in [\"nft\", \"firewall-cmd\", \"ufw\"] {\n    if which(tool).is_some() { break; }\n    eprintln!(\"{tool} not found\");\n}\n// abort early if none found before invoking mise bootstrap firewall","typeGuard":"fn has_firewall_backend(path: &str) -> bool {\n    [\"nft\", \"firewall-cmd\", \"ufw\"].iter().any(|t| path.join(t).exists())\n}","tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"no supported firewall backend\") => {\n        eprintln!(\"install nftables, firewalld, or ufw on this host first\");\n    }\n    other => other?,\n}","preventionTips":["Pre-provision one of nft/firewall-cmd/ufw in base images where mise firewall bootstrap is used.","Pin the backend explicitly in [firewall] config so failures name the expected tool.","Check `which nft firewall-cmd ufw` in host setup scripts before running applies.","Remove the [firewall] section from configs for hosts that should not be firewall-managed."],"tags":["firewall","missing-dependency","backend-detection","nftables"],"backgroundTag":"missing-dependency","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}