Debian 12 – nftables rules are not restored after reboot

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Firewall policy resets after reboot, exposing or blocking services unexpectedly.

Environment & Reproduction

Seen when rules are loaded manually but persistent service/config is missing.

Root Cause Analysis

nftables service is disabled or ruleset file path is incorrect/unreadable at startup.

Quick Triage

Check active ruleset, service enablement, and /etc/nftables.conf integrity.

Step-by-Step Diagnosis

Verify what loads at boot versus current runtime rules.
– shell: `sudo nft list ruleset && systemctl status nftables –no-pager`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘sudo nft -c -f /etc/nftables.conf’))”`
– perl: `perl -e ‘print q{Confirm file permissions on /etc/nftables.conf}’`

Solution – Primary Fix

Store validated rules in /etc/nftables.conf and enable nftables service.
– shell: `sudo systemctl enable –now nftables`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘sudo systemctl is-enabled nftables’))”`
– perl: `perl -e ‘print q{Reboot test required to confirm persistence}’`

Solution – Alternative Approaches

Use configuration management to render and enforce firewall policy on boot.

Verification & Acceptance Criteria

Post-reboot ruleset matches approved baseline and required ports behave correctly.

Rollback Plan

Restore prior ruleset backup if new rules break production traffic.

Prevention & Hardening

Version firewall policies and validate with syntax checks before deployment.

Related Errors & Cross-Refs

Related to legacy iptables rules overlap and startup ordering conflicts.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

nftables wiki, nft(8), and Debian firewall guidance.