NFT002 - Set Name Is Not Qualified

Agent error code #NFT002 indicates that the set name configured on the knoc is not a fully qualified nftables set reference. The agent requires the <family>:<table>:<set> form, for example inet:knocknoc:knoc_ssh_v4.

An unqualified name is ambiguous, because the same set name can exist in several tables and address families at once. The agent refuses the value rather than guess, and no nft command is built from it, so nothing is looked up on the host.

The name must be exactly three colon-separated parts, each containing only letters, digits, _, . and -. The family is one of ip, ip6, inet, arp, bridge or netdev. An empty part, a fourth colon or a space fails the check.

A knoc with no set name at all in either field is #NFT003, not this code.

Common causes include:

• Only the set name was entered, such as knoc_ssh_v4 instead of inet:knocknoc:knoc_ssh_v4
• The separator is wrong. The agent expects colons, not spaces, slashes or dots between the parts
• The table was given but not the family, as knocknoc:knoc_ssh_v4
• A field still holds a bare ipset name carried over from a different backend type

Steps to Resolve

Use the Fully Qualified Form

1. List the sets on the host: sudo nft list sets
2. Read the family and table from the table <family> <table> line and the name from the set <name> line inside it
3. Enter them on the knoc as <family>:<table>:<set>, for example inet:knocknoc:knoc_ssh_v4

Take the Suggestion From Validate

Open the knoc and run Validate connection. The check names the field at fault and offers the sets the agent discovered on the host as one-click fixes. Where you typed a set's own bare name, the discovered set carrying that name is offered as an exact match, so the family and table are filled in for you.

Check Both Address Family Fields

The IPv4 and IPv6 fields each carry their own family and table, which is what allows split layouts such as separate ip and ip6 tables under shorewall-nft. Confirm both fields are qualified, not only the one you last edited.

Ask knocker for the Default Names

If the host was set up with knocker enable nftables, knocker status nftables prints each declared set in the qualified form a knoc expects, ready to paste into the wizard.