Skip to main content

NFT003 - No nftables Set Configured

Agent error code #NFT003 indicates that the knoc uses the nftables backend but names no set wasat configuredall, in either address family. Nothing it grants would ever be applied, so the agent has nowhere to add an address.

This is reported by Validate connection on the knoc, and only when both the IPv4 and the IPv6 field are empty. A knoc that names one family and not the other is a working knoc for that family: it is not this code. Such a knoc rejects a grant for the family it does not cover with an address family beingerror granted.instead, Theso agent has nothing to addconfigure the addresssecond to.set if your users reach the service over both.

A name that was filled in but is not in <family>:<table>:<set> form is #NFT002.

Common causes include:

  • The knoc was saved before the set fields were filled in
  • Only the IPv4 set was configured and the grant is for an IPv6 address, or the reverse
TheBoth set fields were cleared while editing another part of the knoc The knoc was created from a template or a copy that carried no set names

Steps to Resolve

Configure aat Least One Set for the Address Family in Use

  1. Open the knoc in the Knocknoc admin interface
  2. Fill in the setIPv4 forset, the addressIPv6 familyset, theor grantboth, needs,each inas <family>:<table>:<set> form
  3. SaveRun andValidate retryconnection to confirm the grantagent can see them, then save

Decide Whether You Need Both Families

If users reach the protected service over IPv6, configure the IPv6 set as well. A knoc with only an IPv4 set fails every IPv6 grant with this code.

Provision the Default Sets

If the host has no Knocknoc sets yet, run knocker enable nftables on it. That creates themfour sets in thetable inet knocknoc:

table
inet:knocknoc:knoc_ssh_v4
andinet:knocknoc:knoc_ssh_v6
inet:knocknoc:knoc_http_v4
inet:knocknoc:knoc_http_v6

They hold no rules of their own. Reference them from your own ruleset, for example ip saddr @knoc_ssh_v4 tcp dport 22 accept. knocker enable also installs acreate-nft-sets.service, unitwhich that reappliesrecreates them at boot.boot, Setsbecause sets live in the kernel ruleset,ruleset so theyand do not survive a reboot on their own.

Or Use a Set You Declared Yourself

The agent discovers every address-typed set on the host (ipv4_addr or ipv6_addr, with auto-merge excluded), so any set in your own ruleset can be used. See the backends chapter.

Back to top