jdx/mise · error

no supported firewall backend found (tried nft, firewall-cmd

Error message

no supported firewall backend found (tried nft, firewall-cmd, and ufw)

What it means

mise drives the Linux firewall through one of three backends — nftables (`nft`), firewalld (`firewall-cmd`), or ufw (`ufw`) — and auto-detection probes each for its CLI command on PATH. This error means none of the three was found, so there is no way to inspect or converge the `[bootstrap.linux.firewall]` config. Install one of the tools (nftables is preferred) or make its binary visible to mise.

Source

Thrown at src/system/firewall.rs:976

        && backend_available(state.backend)
    {
        return Ok(state.backend);
    }
    for backend in [FirewallBackend::Firewalld, FirewallBackend::Ufw] {
        if backend_available(backend) && backend_active(backend) {
            return Ok(backend);
        }
    }
    for backend in [
        FirewallBackend::Nftables,
        FirewallBackend::Firewalld,
        FirewallBackend::Ufw,
    ] {
        if backend_available(backend) {
            return Ok(backend);
        }
    }
    bail!("no supported firewall backend found (tried nft, firewall-cmd, and ufw)")
}

fn ensure_backend_available(backend: FirewallBackend) -> Result<()> {
    if backend_available(backend) {
        Ok(())
    } else {
        bail!(
            "firewall backend '{}' requires command '{}'",
            backend.label(),
            backend.program().unwrap_or_default()
        )
    }
}

fn backend_available(backend: FirewallBackend) -> bool {
    backend.program().and_then(crate::file::which).is_some()
}

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Install a backend: `apt install nftables` (Debian/Ubuntu), `dnf install firewalld` (RHEL-family), or `apt install ufw`.
2. If the tool is installed but hidden, run with a full PATH: `sudo env PATH="$PATH:/usr/sbin:/sbin" mise bootstrap firewall status`.
3. If this host should not manage a firewall, skip the part: `mise bootstrap --skip firewall`.
4. Remove or comment out `[bootstrap.linux.firewall]` if the config was copied from a different host.

Example fix

# before
mise bootstrap firewall apply
# error: no supported firewall backend found (tried nft, firewall-cmd, and ufw)

# after
sudo apt install -y nftables
mise bootstrap firewall apply

# pre-flight: at least one backend command must exist
command -v nft >/dev/null || command -v firewall-cmd >/dev/null || command -v ufw >/dev/null \
  || { echo 'no firewall backend; install nftables, firewalld, or ufw'; exit 1; }

When it happens

Trigger: `mise bootstrap firewall apply`/`status` (or a full `mise bootstrap` that includes the firewall part) on a host where `command -v nft firewall-cmd ufw` all fail: minimal containers, stripped cloud images, or a PATH that excludes /usr/sbin and /usr/sbin where these tools live, especially under sudo's secure_path.

Common situations: Minimal Docker/Podman images used as dev environments; slim cloud images with no firewall package preinstalled; running via sudo where secure_path omits /usr/sbin:/sbin; config copied from a server to a container that has no firewall stack.

Related errors

• firewall backend '{}' requires command '{}'
• refusing unsafe firewall change; inspect `mise bootstrap fir
• firewall rule '{}' uses interface matching, which firewalld
• firewall rule '{}' uses protocol {}, which UFW does not supp
• firewall rule name '{name}' must contain only ASCII letters,

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/a7051e76d2a1e480. Report an issue: GitHub.