Debian 13 UFW Conflicts With nftables Policy

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Unexpected open or blocked ports despite apparently correct firewall rules.

Environment & Reproduction

Occurs when both UFW and custom nftables sets are managed simultaneously.

Root Cause Analysis

Two control planes overwrite each other and produce inconsistent effective policy.

Quick Triage

Determine which framework is authoritative for host firewall policy.

Step-by-Step Diagnosis

Trace packet path and matching chains for target service ports.

Solution – Primary Fix

Choose one firewall manager and disable the other.

Solution – Alternative Approaches

Keep UFW only and remove custom nftables include rules.

Verification & Acceptance Criteria

Port checks align with expected policy and persist after reboot.

Rollback Plan

Re-enable prior firewall service if connectivity regression is detected.

Prevention & Hardening

Document a single firewall ownership model per environment.

Related Errors & Cross-Refs

Related to duplicate chain priorities and unexpected NAT behavior.

Related tutorial: View the step-by-step tutorial for Debian 13.

View all Debian 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian firewall framework compatibility notes.