NFT002 - Set Name Is Not Qualified

Agent error code #NFT002 indicates that the set name configured on the knoc is not a fully qualified nftables set reference. The agent requires the <family>:<table>:<set> form, for example inet:knocknoc:knocknoc_v4.

An unqualified name is ambiguous because the same set name can exist in several tables and address families at once. Knocknoc refuses the value rather than guessing which set was meant.

Common causes include:

• Only the set name was entered, such as knocknoc_v4 instead of inet:knocknoc:knocknoc_v4
• The separator is wrong. The agent expects colons, not spaces or slashes
• A field was left with an ipset-style name carried over from a different backend type

Steps to Resolve

Use the Fully Qualified Form

1. List the sets on the host: sudo nft -j list sets
2. Read the family, table and set name from the output
3. Enter them in the knoc as <family>:<table>:<set>, for example inet:knocknoc:knocknoc_v4

Check Both Address Family Fields

The IPv4 and IPv6 fields each carry their own family and table, which is what allows split-family layouts such as shorewall-nft's separate ip and ip6 tables. Confirm both fields are qualified, not just the one you last edited.

Run the Knoc Validator

The nftables backend can check its own configuration. Open the knoc and run Validate to have the agent report the exact field at fault along with a suggested value.