Arch Linux

zar3bski

Member

Registered: 2026-08-20

Posts: 3

Empty nft list ruleset while config changes seem enforced by netfilter

I've been using nftables on several machines for 2 years and I'm puzzled by this recent nft behavior: sudo nft list ruleset does not display anything while it used to do so.

I have good reasons to believe that the rules defined in /etc/nftables.conf are valid and received by netfilter for 3 reasons:

1. worked before

2. sudo nft -f /etc/nftables.conf; echo "rc: $?" => 0 . Introducing syntax errors, I get the expected 1

3. I can curl myself from the LAN on 8000 (allowed by the conf) but not on 8001, conf edition changes this behavior, but my log prefix does not allow me to see all the dropped packets in journalctl -k --grep anymore: some show up, others do not

I ruled out a few obvious possible explanations but I do not understand what to do with this case where things kinda work while being broken in the same time.

Amongst the weird part

    sudo nft --version : empty, exit code 0

Linux tr1an9vlvm 7.1.8-arch1-3 #1 SMP PREEMPT_DYNAMIC Tue, 11 Aug 2026 09:16:08 +0000 x86_64 GNU/Linux

Any idea on what could be causing this? Any breaking change I missed recently?

Last edited by zar3bski (Yesterday 08:42:12)

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 758

Re: Empty nft list ruleset while config changes seem enforced by netfilter

# systemctl status nftables.service
# systemctl cat nftables.service
# ip netns identify
# lsmod | grep -P '^nft?_'
# type nft
# pacman -Qo nft
# pacman -Qkk nftables

zar3bski

Member

Registered: 2026-08-20

Posts: 3

Re: Empty nft list ruleset while config changes seem enforced by netfilter

Hi Dimich.

Thanks a lot for your answer. I checked all of this yesterday, had a look at aa-log and completely missed what strikes me this morning

ALLOWED konsole open owner @{PROC}/@{pid}/task/@{tid}/children comm=konsole requested_mask=r denied_mask=r
ALLOWED konsole open @{PROC}/@{pid}/task/@{tid}/children comm=konsole requested_mask=r denied_mask=r
DENIED  nft file_inherit /dev/pts/3 comm=nft requested_mask=wr denied_mask=wr
ALLOWED konsole open owner @{PROC}/@{pid}/task/@{tid}/children comm=konsole requested_mask=r denied_mask=r

I did not take the reflex to update https://apparmor.pujol.io/ as apparmor upgrade and it looks like it fooled me.
Your check list is perfect. Thanks.

zar3bski

Member

Registered: 2026-08-20

Posts: 3

Re: Empty nft list ruleset while config changes seem enforced by netfilter

I'm new to this forum and I'm not sure how I can set [Solved], for I can't edit the title of the initial post

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,334

Re: Empty nft list ruleset while config changes seem enforced by netfilter

If you can't edit the title in the initial post it's likely because you're hitting the char limit, try shortening it a bit