Remove all non-provided .service's within PartOf of fail2ban.service As reported and corroborated in the bug report, this causes inability of firewalld to restart. Correct solution would involve making systemd smarter and tune up of involved .service files. Since Debian ATM doesn't provide any of those ({ip{,6}tables,ipset}.service) files, it should be safe and generic enough to just prune them from PartOf
Thanks Joe Cooper <swelljoe@gmail.com> and Sunil Mohan Adapa <sunil@medhas.org> for the reports and nagging ;)