Ubuntu 26.04 LTS UFW and nftables Policy Conflict

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Traffic filtering behaves unpredictably because multiple rule managers modify packet paths.

Environment & Reproduction

Manual nftables rules are added on hosts where UFW already owns policy lifecycle.

sudo nft list ruleset

Root Cause Analysis

Conflicting chains and priorities lead to unexpected allows or drops before intended rules apply.

Quick Triage

Check UFW status and non-UFW nft tables.

sudo ufw status verbose && sudo nft list tables

Step-by-Step Diagnosis

Identify direct nft rules not generated by UFW and chain priority overlap.

sudo nft -a list ruleset

Solution – Primary Fix

Choose a single firewall control plane, remove unmanaged nft rules, and reload UFW cleanly.

sudo ufw disable && sudo nft flush ruleset && sudo ufw enable

Solution – Alternative Approaches

Disable UFW entirely and manage nftables declaratively with one authoritative ruleset.

Verification & Acceptance Criteria

Effective firewall policy is deterministic and matches approved ingress/egress matrix.

Rollback Plan

Restore exported nftables backup or prior UFW profile from version control.

Prevention & Hardening

Enforce policy ownership in operations standards and block ad hoc firewall edits.

Related Errors & Cross-Refs

Correlates with asymmetric routing, duplicate NAT, and unexpected return traffic drops.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu UFW backend and nftables administration documentation.