Provision failing at ferm: ensure iptables INPUT rules are added

Using the current version of the trellis-cli (1.9.0), I’m getting an issue bringing a project up for the first time. I’ve never had this particular issue, and I just updated the trellis-cli today. The output isn’t helping too much to point me in the right direction unfortunately, and I’m not super familiar with what is going on with this task in the background, so any help at all would be appreciated.

Failure output:

TASK [ferm : ensure iptables INPUT rules are added] ****************************
fatal: [default]: FAILED! => {"msg": "invalid or malformed argument: ' '"}
1 Like

What Ubuntu version is that system running?

It looks like this is failing on both the latest (22.04) and previous (20.04) versions of Ubuntu

The Trellis integration test failed last night with this same error when the only change was to the README: 📝 Update README · roots/trellis@23cafb4 · GitHub

It also looks like Ansible released 2.14.3 yesterday which is likely responsible for this error


I bumped into this and got back on track by requiring ansible at 2.10.7 in requirements.txt:


I also wiped .trellis/virtualenv. Versions >2.10.7 didn’t work when specified in requirements.txt (it just used 2.14.3 as if I hadn’t specified anything or complained that the version didn’t exist, even if it did).

After that, all was well.


Thanks for the input and context @kellymears and @ben

I’ve tried Kelly’s solution and it appears to have gotten me through this for the time being. I’m going to hold off on accepting an answer for the time being as it’s more of a workaround though, and wait for the roots team to either update something in trellis or recommend that this is the best approach.

This was super helpful though. Thanks!


hm, getting this same iptables error on a completely new trellis/trellis-cli 1.10.1, vagrant 2.3.4, python 3.9.6 install on Mac OS 13.2.1.

I tried using @kellymears tip requiring ansible 2.10.7 and removing later versions of ansible, and I’m still seeing the same iptables error on trellis up.

Not sure where to go next…

I appreciate people posting on here, but why wasn’t this an issue on the trellis repo? :sweat_smile:

I’ve fixed it and released v1.20.1: Release v1.20.1 · roots/trellis · GitHub


my apologies. Thanks for the fix.

Hi, I am just now running trellis-cli v1.10.1 obtained via brew install. I am experiencing the error FAILED! => {“msg”: "invalid or malformed argument on TASK [ferm : ensure iptables INPUT rules are added] while executing trellis up.

I see the solution is v1.20.1 (thank you), but I see compressed files for source that do not appear to have the Go code. I can build from source, but the result is version = canary and with that version (canary) I still get the error on TASK [ferm : ensure iptables INPUT rules are added].

My coworkers obtained trellis-cli from brew install some days ago and they got v1.9 and they are able to successfully trellis up.

Can you offer suggestions about building v1.12 from source or getting v1.12 via brew? I also tried a manual install of v1.9 on MacOS, but I still got the error.

Any help is greatly appreciated.


I think you’re confused between Trellis and trellis-cli. The bug, and the fix, is in Trellis itself (specifically in an Ansible role/task. See Fix invalid arg error in ferm task by swalkinshaw · Pull Request #1480 · roots/trellis · GitHub).

For existing projects, you need to apply that fix (or the entire release) manually by pulling the code via Git.

The trellis-cli version has nothing to do with this bug/fix since the CLI is a management tool for Trellis.

If you started a brand new project with trellis new, it would use the latest published version of Trellis by default (which is now v1.20.1 and includes that fix). But again, for existing projects, the CLI version doesn’t impact this at all.


I looked at the commits and realized the change needed to address the error was in roles/ferm/tasks/main.yml and not related to the binary. I am up and running successfully now. Thanks very much.


1 Like

Hi @swalkinshaw, sorry to bother, I have applied this suggested solution Fix invalid arg error in ferm task by swalkinshaw · Pull Request #1480 · roots/trellis · GitHub and that error disappeared. Nevertheless, now provision gets stuck on worpress-install task:

No error message or anything, just hangs there. Any suggestion on how to proceed?
Thanks in advance,


@yano1978 please create a new topic with more details on your setup and the full log output.

Replying with a separate off-topic issue isn’t good for information organization and it’s less likely you’ll get help since it’s less visible.

1 Like