Debian 12 – UFW and nftables policy mismatch causes traffic drops – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Expected allow rules are present but traffic is still dropped unexpectedly.

Environment & Reproduction

Occurs when UFW-managed policy coexists with manual nftables changes.

Root Cause Analysis

Rule evaluation order and backend assumptions diverge between toolchains.

Quick Triage

Capture effective state from both `sudo ufw status verbose` and `sudo nft list ruleset`.

Step-by-Step Diagnosis

Identify duplicate/conflicting chains and verify which backend is authoritative on boot.

Solution – Primary Fix

Choose one firewall authority, remove conflicting rules, and persist a single policy source.

Solution – Alternative Approaches

Temporarily disable one layer during troubleshooting to isolate behavior.

Verification & Acceptance Criteria

Connectivity tests pass and rule behavior remains consistent after reboot.

Rollback Plan

Restore previous firewall snapshots if service exposure or blocking is incorrect.

Prevention & Hardening

Document firewall ownership and prohibit parallel manual rule edits.

Related Errors & Cross-Refs

Related to cloud ACL mismatches and reverse proxy bind constraints.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian firewall administration docs for UFW and nftables.