Debian 13 – nftables Rules Lost After Reboot – Persistence and Policy Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Firewall policy disappears after reboot, exposing or blocking critical services unexpectedly.

Environment & Reproduction

Rules were entered interactively but not saved to nftables.conf.

Root Cause Analysis

Runtime rules are not persisted unless exported to configuration and loaded at boot.

Quick Triage

Determine whether desired policy exists in runtime and on-disk config.

Step-by-Step Diagnosis

Check service enablement and boot-time load errors.

Solution – Primary Fix

Save validated ruleset to /etc/nftables.conf and enable nftables service.

Solution – Alternative Approaches

Manage rules using configuration management for deterministic policy.

Verification & Acceptance Criteria

Rules survive service restart and full reboot.

Rollback Plan

Restore previous nftables.conf if newly persisted policy blocks required traffic.

Prevention & Hardening

Use policy review and staged rollouts before firewall changes in production.

Related Errors & Cross-Refs

Ruleset empty after boot, nftables service inactive, connection refused.

Related tutorial: View the step-by-step tutorial for Debian 13.

View all Debian 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian nftables persistence and firewall policy best practices.