How do I inspect nftables rules without flushing or changing them?
nftables organises rules into families, tables and chains. Read the complete relevant chain so that rule order, hooks and policy are considered together. A ruleset may be generated by another manager, so direct edits can be overwritten or conflict with that manager’s configuration.
Before you start
- Sudo access for ruleset inspection.
- Knowledge of any firewall or container manager that generates rules.
Instructions
1. List tables first
Identify whether policy is in inet, ip, ip6 or another family. An inet table can process both IPv4 and IPv6 traffic, while family-specific tables have narrower scope.
sudo nft list tablesLists table names and families without changing them.
2. Read the relevant table or full ruleset
Use the full ruleset when investigating an unfamiliar layout, then narrow to the table returned above. Rule handles help identify entries but are not permanent identifiers across reloads.
sudo nft -a list rulesetDisplays rule handles alongside the active configuration. This is an inspection command, not a flush or reload.
3. Trace the policy logically
Check hook, priority, chain policy and matching earlier rules. NAT, forwarding and container-managed chains may affect traffic even when an input-chain rule looks permissive. Keep internal address information private when sharing extracts.
Check the result
- The relevant address family and packet path are identified, including the manager responsible for any generated rules.
- A proposed fix targets the owning configuration rather than a transient generated entry.
Troubleshooting
- The visible rules reappear after being edited elsewhere
- Identify the management service that regenerates them. Coordinate a supported configuration change instead of repeatedly flushing live tables.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.