Hi,
Just a heads-up for anyone upgrading Proxmox Mail Gateway (PMG) 8 → 9.
My PMG 8 was originally installed using the Proxmox ISO, and I later upgraded the existing installation to PMG 9. After the upgrade, I discovered that iptables was no longer available on the system and nftables was being used instead.
Because my Fail2Ban configuration was still using the `iptables-multiport` action, Fail2Ban appeared to be banning brute-force IPs, but the firewall rules were actually failing to apply.
I noticed this error in the Fail2Ban logs:
```text
2026-09-13 00:33:45,228 fail2ban.actions [15009]: ERROR Failed to execute ban jail 'sshd' action 'iptables-multiport' info 'ActionInfo({'ip': '193.47.62.69', 'family': 'inet4', ...})': Error starting action Jail('sshd')/iptables-multiport: 'Script error'
```
So although Fail2Ban was detecting the attacks and attempting to ban the IPs, **the offending IPs weren't actually being blocked**.
If you've recently upgraded your Mail Gateway to PMG 9, it may be worth checking your Fail2Ban logs and making sure your configured ban action is compatible with **nftables**.
Henry
Just a heads-up for anyone upgrading Proxmox Mail Gateway (PMG) 8 → 9.
My PMG 8 was originally installed using the Proxmox ISO, and I later upgraded the existing installation to PMG 9. After the upgrade, I discovered that iptables was no longer available on the system and nftables was being used instead.
Because my Fail2Ban configuration was still using the `iptables-multiport` action, Fail2Ban appeared to be banning brute-force IPs, but the firewall rules were actually failing to apply.
I noticed this error in the Fail2Ban logs:
```text
2026-09-13 00:33:45,228 fail2ban.actions [15009]: ERROR Failed to execute ban jail 'sshd' action 'iptables-multiport' info 'ActionInfo({'ip': '193.47.62.69', 'family': 'inet4', ...})': Error starting action Jail('sshd')/iptables-multiport: 'Script error'
```
So although Fail2Ban was detecting the attacks and attempting to ban the IPs, **the offending IPs weren't actually being blocked**.
If you've recently upgraded your Mail Gateway to PMG 9, it may be worth checking your Fail2Ban logs and making sure your configured ban action is compatible with **nftables**.
Henry
