Skip to main content

NFT050 - nftables Set Does Not Exist

Agent error code #NFT050 indicates that the configured set could not be found on the agent host. The kernel, not a cached listing, is the authority here: at grant time the code is raised only when nft itself reported the set or its table as missing.

It is also what Validate connection reports for a set the agent could not discover, and for a set it did discover that holds the other address family. A set of ipv6_addr elements named in the IPv4 field cannot take an IPv4 grant, so it is reported the same way as one that is not there.

Common causes include:

  • The host was rebooted and the sets were never recreated. nftables sets live in the kernel ruleset and do not persist across a reboot on their own
  • A firewall service reloaded and flushed the ruleset. A stock /etc/nftables.conf opens with flush ruleset, which removes tables it does not itself define
  • The set name, table or family on the knoc does not match what exists on the host. Every part is case-sensitive
  • The set has auto-merge enabled, so the agent skips it during discovery and Validate reports it missing even though nft list set shows it
  • The set holds something other than plain addresses, such as a concatenated type like ipv4_addr . inet_service. Only ipv4_addr and ipv6_addr sets can be managed
  • The IPv4 field names an ipv6_addr set, or the reverse
  • The set was renamed or deleted on the host after the knoc was configured

Steps to Resolve

Confirm What the Host Actually Has

  1. List every set with its definition: sudo nft list sets
  2. Compare the family, table and set name against the knoc, character for character
  3. Check the type line. It must read ipv4_addr for an IPv4 set and ipv6_addr for an IPv6 set

Remove auto-merge From the Set

auto-merge coalesces adjacent elements into ranges, which leaves the agent unable to add and remove grants individually, so it never offers the set. Flags cannot be changed in place, so drop auto-merge from the declaration and recreate the set:

sudo nft delete set <family> <table> <set>
sudo nft -f /path/to/your/sets.nft

Recreating empties the set, so any address currently granted through it is withdrawn until the next grant.

Recreate the Knocknoc Sets

If the default sets are gone:

  1. Run sudo systemctl start create-nft-sets.service to reapply them from /opt/knocknoc-agent/etc/knocknoc-sets.nft
  2. If the unit is not installed, run knocker enable nftables, which creates the sets and installs it
  3. knocker status nftables lists each declared set and whether it is present in the running ruleset

Make the Sets Survive a Reload

create-nft-sets.service orders itself After=nftables.service firewalld.service on purpose. A unit that runs before those services has its table wiped by the stock config's flush ruleset moments later. If you declare the sets in your own file instead, apply it after anything that flushes.

Check for a Competing Firewall Manager

firewalld, shorewall-nft and similar tools rewrite the ruleset on reload. If one of them owns the ruleset on this host, keep the Knocknoc set in a table that tool does not flush, or reapply the set from that tool's own reload hook.

Back to top