Debian 11 – nftables rules not applied after reboot – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Firewall policy disappears on reboot, exposing services or breaking expected traffic filtering.

Environment & Reproduction

Appears when rules are loaded manually but not saved to /etc/nftables.conf or service is disabled.

Root Cause Analysis

nftables service startup lacks valid persistent rules file or fails due to syntax errors.

Quick Triage

Check active ruleset, service state, and boot-time logs first.

Step-by-Step Diagnosis

Run: sudo nft list ruleset; systemctl status nftables; sudo journalctl -u nftables -b; sudo nft -c -f /etc/nftables.conf.

Solution – Primary Fix

Save tested rules to /etc/nftables.conf and run: sudo systemctl enable –now nftables; sudo systemctl restart nftables.

Solution – Alternative Approaches

Manage firewall via automation templates and unit tests for nft syntax before deployment.

Verification & Acceptance Criteria

After reboot, expected chains and policies are present and enforced.

Rollback Plan

Reapply previous ruleset backup with nft -f and restart service if connectivity breaks.

Prevention & Hardening

Add CI validation using nft -c and boot validation checks in post-patch health scripts.

Related Errors & Cross-Refs

Linked to malformed set definitions, missing include files, and netfilter backend conflicts.

Related tutorial: View the step-by-step tutorial for Debian 11.

View all Debian 11 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian nftables package docs and nftables official wiki examples.