NFT050 - nftables Set Does Not Exist

Agent error code #NFT050 indicates that nft reported the configured set as missing from the kernel ruleset. This is checked against the host at the time of the grant, so the set was genuinely absent when the grant was applied.

Common causes include:

• The host was rebooted and the sets were never reapplied. nftables sets live in the kernel ruleset and do not persist across a reboot on their own
• A firewall service reloaded and flushed the ruleset. A stock /etc/nftables.conf opens with flush ruleset, which removes tables it does not itself define
• The set name, table or family in the knoc does not match what exists on the host
• The set was renamed or deleted on the host after the knoc was configured

Steps to Resolve

Confirm What the Host Actually Has

1. List every set: sudo nft -j list sets
2. Compare the family, table and set name against the knoc configuration, character for character. Names are case-sensitive

Recreate the Sets

If the sets are gone:

1. Run knocker enable nftables to provision the default sets in the inet knocknoc table
2. This also installs create-nft-sets.service, which reapplies them at boot

Make the Sets Survive a Reload

create-nft-sets.service deliberately orders itself After nftables.service and firewalld.service. If you write your own unit, order it the same way. Running before those services means the stock config's flush ruleset wipes the table straight after you create it.

Check for a Competing Firewall Manager

firewalld, shorewall-nft and similar tools rewrite the ruleset on reload. If one of them owns the ruleset on this host, place the Knocknoc set in a table that tool does not flush, or reapply the set on its reload hook.