Debian 10 – nftables Rules Missing After Reboot – Persistent Firewall Setup

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Expected firewall policy disappears after reboot, exposing services or blocking required traffic unexpectedly.

Environment & Reproduction

Happens when admins load runtime rules but do not persist /etc/nftables.conf on Buster.

Root Cause Analysis

nftables service starts with empty or outdated configuration, replacing manually loaded runtime state.

Quick Triage

Check nft list ruleset and systemctl status nftables immediately after boot cycle.

Step-by-Step Diagnosis

Review /etc/nftables.conf syntax, startup ordering, and journal messages for load-time parse failures.

Solution – Primary Fix

Save validated rules to /etc/nftables.conf, enable service, and test controlled reboot persistence.

Solution – Alternative Approaches

Use configuration management templates to deploy deterministic nftables policy across fleet nodes.

Verification & Acceptance Criteria

Post-reboot ruleset matches baseline and expected ports are allowed or denied correctly.

Rollback Plan

Restore previous firewall file and restart nftables if new policy interrupts critical traffic.

Prevention & Hardening

Validate firewall syntax in CI and add boot-time compliance checks for critical chains.

Related Errors & Cross-Refs

nftables.service failed, syntax error near token, and missing chain/table definitions.

Related tutorial: View the step-by-step tutorial for Debian 10.

View all Debian 10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian nftables wiki and upstream nft command and syntax documentation.