NFT003 - No nftables Set Configured

Agent error code #NFT003 indicates that the knoc uses the nftables backend but no set was configured for the address family being granted. The agent has nothing to add the address to.

Common causes include:

• The knoc was saved before the set fields were filled in
• Only the IPv4 set was configured and the grant is for an IPv6 address, or the reverse
• The set fields were cleared while editing another part of the knoc

Steps to Resolve

Configure a Set for the Address Family in Use

1. Open the knoc in the Knocknoc admin interface
2. Fill in the set for the address family the grant needs, in <family>:<table>:<set> form
3. Save and retry the grant

Decide Whether You Need Both Families

If users reach the protected service over IPv6, configure the IPv6 set as well. A knoc with only an IPv4 set fails every IPv6 grant with this code.

Provision the Default Sets

If the host has no Knocknoc sets yet, knocker enable nftables creates them in the inet knocknoc table and installs a unit that reapplies them at boot. Sets live in the kernel ruleset, so they do not survive a reboot on their own. See the backends chapter.