Skip to main content

NFT003 - No nftables Set Configured

Agent error code #NFT003 indicates that the knoc uses the nftables backend but names no set at all, in either address family. Nothing it grants would ever be applied, so the agent has nowhere to add an address.

This is reported by Validate connection on the knoc, and only when both the IPv4 and the IPv6 field are empty. A knoc that names one family and not the other is a working knoc for that family: it is not this code. Such a knoc rejects a grant for the family it does not cover with an address family error instead, so configure the second set if your users reach the service over both.

A name that was filled in but is not in <family>:<table>:<set> form is #NFT002.

Common causes include:

  • The knoc was saved before the set fields were filled in
  • Both set fields were cleared while editing another part of the knoc
  • The knoc was created from a template or a copy that carried no set names

Steps to Resolve

Configure at Least One Set

  1. Open the knoc in the Knocknoc admin interface
  2. Fill in the IPv4 set, the IPv6 set, or both, each as <family>:<table>:<set>
  3. Run Validate connection to confirm the agent can see them, then save

Provision the Default Sets

If the host has no Knocknoc sets yet, run knocker enable nftables on it. That creates four sets in table inet knocknoc:

inet:knocknoc:knoc_ssh_v4
inet:knocknoc:knoc_ssh_v6
inet:knocknoc:knoc_http_v4
inet:knocknoc:knoc_http_v6

They hold no rules of their own. Reference them from your own ruleset, for example ip saddr @knoc_ssh_v4 tcp dport 22 accept. knocker enable also installs create-nft-sets.service, which recreates them at boot, because sets live in the kernel ruleset and do not survive a reboot on their own.

Or Use a Set You Declared Yourself

The agent discovers every address-typed set on the host (ipv4_addr or ipv6_addr, with auto-merge excluded), so any set in your own ruleset can be used. See the backends chapter.

Back to top