Debian 12 – nftables rules accidentally block SSH access – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote administration fails after firewall policy updates, risking lockout.

Environment & Reproduction

Typically appears after default-deny rules are enabled without explicit SSH permits.

sudo nft list ruleset
ss -lntp | grep :22
ssh -v localhost

Root Cause Analysis

Missing or misordered SSH accept rule blocks management traffic.

Quick Triage

Validate chain defaults and current input rules.

sudo nft list ruleset
sudo journalctl -k -n 80 --no-pager
ip -br a

Step-by-Step Diagnosis

Confirm sshd listener and packet path at host level.

sudo systemctl status ssh
ss -lntp | grep :22
sudo tcpdump -ni any port 22 -c 20

Solution – Primary Fix

Add explicit SSH allow rule ahead of restrictive drops.

sudo nft add rule inet filter input tcp dport 22 ct state new,established accept
sudo nft list ruleset
sudo systemctl restart ssh

Solution – Alternative Approaches

Limit SSH to admin CIDR blocks for tighter security.

sudo nft add rule inet filter input ip saddr 203.0.113.0/24 tcp dport 22 accept
sudo nft list ruleset
ss -lntp | grep :22

Verification & Acceptance Criteria

SSH login succeeds from management network and localhost.

ssh -o ConnectTimeout=5 localhost true
ss -lntp | grep :22
sudo nft list ruleset

Rollback Plan

Flush temporary policy from console if lockout persists.

sudo nft flush ruleset
sudo systemctl restart ssh
ip a

Prevention & Hardening

Always stage SSH allows before enforcing deny-all input policies.

sudo nft list ruleset > /etc/nftables.conf
sudo systemctl enable --now nftables
sudo systemctl status ssh

Related Errors & Cross-Refs

May coincide with cloud ACL or security-group ingress misconfiguration.

Related tutorial: View the step-by-step tutorial for Debian 12.

View all Debian 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian nftables and OpenSSH hardening documentation.