📖 ~1 min read
Table of contents
Symptom & Impact
Firewall policy reverts after reboot, exposing services or blocking required traffic unexpectedly.
Environment & Reproduction
Often seen when runtime rules are applied manually but not committed to persistent config.
Root Cause Analysis
nftables/iptables runtime state is ephemeral unless restored by boot-time service configuration.
Quick Triage
Check active rule set now, then compare to on-disk rules file and enabled startup units.
Step-by-Step Diagnosis
Run nft list ruleset or iptables-save, inspect /etc/nftables.conf, and verify systemctl is-enabled nftables.
Solution – Primary Fix
Save validated rules to persistent file, enable firewall service, and reboot test in maintenance window.
Still having issues? Our IT Consulting team can diagnose and resolve this for you. Get in touch for a free consultation.
Solution – Alternative Approaches
Use higher-level tooling like ufw where policy simplicity and operational consistency are priorities.
Verification & Acceptance Criteria
Post-reboot rule set matches approved baseline and external connectivity tests meet policy outcomes.
Rollback Plan
Reapply prior rules file and restart firewall service if new baseline blocks business-critical paths.
Prevention & Hardening
Version-control firewall configs and validate changes with pre/post reboot CI checks.
Related Errors & Cross-Refs
Correlated incidents include unexpected open ports and denied internal service calls after restart.
Related tutorial: View the step-by-step tutorial for debian-11.
View all debian-11 tutorials on the Tutorials Hub →
Browse all common problems & solutions on the Tutorials Hub.
References & Further Reading
Review Debian nftables documentation and Linux packet filtering best practices.
Need Expert Help?
If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.
