Ubuntu 26.04 LTS – nftables backend conflicts with legacy iptables scripts

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators observe: Ubuntu 26.04 LTS – nftables backend conflicts with legacy iptables scripts. Security policies become inconsistent across reboots.

Environment & Reproduction

Issue appears after upgrades where automation still assumes iptables-legacy behavior.

# Baseline context
lsb_release -a
update-alternatives --display iptables
iptables --version
nft --version
sudo systemctl status ufw --no-pager

Root Cause Analysis

Rule loaders targeting iptables-legacy may not reflect in nft ruleset used by active firewall stack.

Quick Triage

Compare active rules from both tooling layers.

# Quick triage
sudo iptables -S
sudo nft list ruleset
sudo ufw status verbose

Step-by-Step Diagnosis

Locate scripts or services enforcing legacy commands and check unit ordering.

# Detailed diagnosis
sudo grep -R 'iptables' /etc/systemd /etc/network /usr/local/bin 2>/dev/null | head -n 80
systemctl list-unit-files | grep -i firewall
systemd-analyze critical-chain

Solution – Primary Fix

Standardize on nftables-compatible tooling and remove legacy rule loaders.

# Primary fix
sudo update-alternatives --set iptables /usr/sbin/iptables-nft
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
sudo systemctl restart ufw
sudo nft list ruleset

Solution – Alternative Approaches

If legacy is required temporarily, switch all tooling consistently and document risk.

# Alternative
sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
sudo systemctl restart ufw

Verification & Acceptance Criteria

Firewall state is consistent and persists across reboot with expected packet filtering.

# Verify
update-alternatives --display iptables
sudo nft list ruleset | head -n 120
sudo ufw status verbose

Rollback Plan

Restore previous alternatives and firewall service order if compatibility issues appear.

# Rollback
sudo update-alternatives --auto iptables
sudo update-alternatives --auto ip6tables
sudo systemctl restart ufw

Prevention & Hardening

Audit automation to ensure one firewall backend model is used everywhere.

# Hardening
sudo grep -R 'iptables-legacy' /etc /usr/local/bin 2>/dev/null || true
sudo systemctl daemon-reload

Related Errors & Cross-Refs

Related patterns include rules vanishing after reboot and UFW status not matching effective packet path behavior.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu firewall backend guidance, nftables manual, and update-alternatives documentation.