Oracle Linux 10 – nftables rule order drops established traffic – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Existing connections reset unexpectedly and application sessions drop.

Environment & Reproduction

Seen after manual nft updates or policy migration from legacy tools.

nft list ruleset
ss -tn
conntrack -S

Root Cause Analysis

Rule ordering places broad drop rules ahead of established related accepts.

Quick Triage

Inspect chain priority and first matching rules.

nft list chain inet filter input
nft list chain inet filter forward
journalctl -k -n 60

Step-by-Step Diagnosis

Identify packets hitting unexpected terminal drop statements.

nft monitor trace
nft list ruleset -a

Solution – Primary Fix

Move established related accept rule before broad drop rules.

nft insert rule inet filter input ct state established,related accept
nft add rule inet filter input tcp dport 22 accept
nft list chain inet filter input

Solution – Alternative Approaches

Temporarily apply permissive policy while rebuilding final chains.

nft flush chain inet filter input
nft add rule inet filter input accept

Verification & Acceptance Criteria

Established sessions persist and new approved flows succeed.

ssh localhost
ss -tn state established
conntrack -L | head

Rollback Plan

Restore last known good nftables ruleset.

nft -f /root/nftables.backup.conf

Prevention & Hardening

Use version controlled nftables templates and rule simulation in staging.

nft -c -f /etc/nftables.conf

Related Errors & Cross-Refs

Can resemble MTU issues and reverse path filtering side effects.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Oracle Linux nftables administration and migration references.