Skip to main content

NFT002 - Set Name Is Not Qualified

Agent error code #NFT002 indicates that the set name configured on the knoc is not a fully qualified nftables set reference. The agent requires the <family>:<table>:<set> form, for example inet:knocknoc:knocknoc_v4knoc_ssh_v4.

An unqualified name is ambiguousambiguous, because the same set name can exist in several tables and address families at once. KnocknocThe agent refuses the value rather than guessingguess, whichand no nft command is built from it, so nothing is looked up on the host.

The name must be exactly three colon-separated parts, each containing only letters, digits, _, . and -. The family is one of ip, ip6, inet, arp, bridge or netdev. An empty part, a fourth colon or a space fails the check.

A knoc with no set wasname meant.at all in either field is #NFT003, not this code.

Common causes include:

  • Only the set name was entered, such as knocknoc_v4knoc_ssh_v4 instead of inet:knocknoc:knocknoc_v4knoc_ssh_v4
  • The separator is wrong. The agent expects colons, not spacesspaces, slashes or slashesdots between the parts
The table was given but not the family, as knocknoc:knoc_ssh_v4 A field wasstill leftholds witha anbare ipset-styleipset name carried over from a different backend type

Steps to Resolve

Use the Fully Qualified Form

  1. List the sets on the host: sudo nft -j list sets
  2. Read the family,family and table from the table <family> <table> line and setthe name from the outputset <name> line inside it
  3. Enter them inon the knoc as <family>:<table>:<set>, for example inet:knocknoc:knocknoc_v4knoc_ssh_v4

Take the Suggestion From Validate

Open the knoc and run Validate connection. The check names the field at fault and offers the sets the agent discovered on the host as one-click fixes. Where you typed a set's own bare name, the discovered set carrying that name is offered as an exact match, so the family and table are filled in for you.

Check Both Address Family Fields

The IPv4 and IPv6 fields each carry their own family and table, which is what allows split-familysplit layouts such as shorewall-nft's separate ip and ip6 tables.tables under shorewall-nft. Confirm both fields are qualified, not justonly the one you last edited.

RunAsk knocker for the KnocDefault ValidatorNames

The nftables backend can check its own configuration. OpenIf the host was set up with knocker enable nftables, knocker status nftables prints each declared set in the qualified form a knoc andexpects, run Validateready to havepaste into the agent report the exact field at fault along with a suggested value.wizard.

Back to top