Debian 9 – nftables rules accidentally block SSH access – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote SSH sessions fail after firewall changes, risking admin lockout.

Environment & Reproduction

Typically occurs after policy default-deny rules are enabled.

sudo nft list ruleset
ss -lntp | grep :22
ssh -v localhost

Root Cause Analysis

Missing or misordered SSH allow rule blocks inbound management traffic.

Quick Triage

Inspect effective filter chains and policy defaults.

sudo nft list ruleset
sudo journalctl -k -n 80 --no-pager
ip -br a

Step-by-Step Diagnosis

Confirm sshd is listening and packets reach the host interface.

sudo systemctl status ssh
ss -lntp | grep :22
sudo tcpdump -ni any port 22 -c 20

Solution – Primary Fix

Insert explicit SSH allow rule before restrictive drops.

sudo nft add rule inet filter input tcp dport 22 ct state new,established accept
sudo nft list ruleset
sudo systemctl restart ssh

Solution – Alternative Approaches

Limit SSH access to admin CIDR ranges for tighter control.

sudo nft add rule inet filter input ip saddr 203.0.113.0/24 tcp dport 22 accept
sudo nft list ruleset

Verification & Acceptance Criteria

SSH succeeds locally and from remote management network.

ssh -o ConnectTimeout=5 localhost true
ss -lntp | grep :22
sudo nft list ruleset

Rollback Plan

Flush temporary rules from console if lockout persists.

sudo nft flush ruleset
sudo systemctl restart ssh

Prevention & Hardening

Always stage SSH allow rules before enforcing deny defaults.

sudo nft list ruleset > /etc/nftables.conf
sudo systemctl enable --now nftables

Related Errors & Cross-Refs

Can overlap with cloud security-group or ACL misconfiguration.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian nftables and OpenSSH hardening guidance.