[19:45] <blackboxsw> bigon: thanks for this reference. It does look like firewalld is positioning itself in an ordering cycle on Debian w/ cloud-init-local https://github.com/firewalld/firewalld/issues/414. I just reponded there tossing a couple of things to try on the issue that may be of some  help.  If we need to opinionate Debian templates to better support firewalld in cloud-init it is possible that we could make a change upstream for this