Skip to main content

NFT050 - nftables Set Does Not Exist

Agent error code #NFT050 indicates that nft reported the configured set ascould missingnot frombe found on the kernelagent ruleset.host. ThisThe kernel, not a cached listing, is checkedthe againstauthority here: at grant time the hostcode atis raised only when nft itself reported the timeset or its table as missing.

It is also what Validate connection reports for a set the agent could not discover, and for a set it did discover that holds the other address family. A set of ipv6_addr elements named in the IPv4 field cannot take an IPv4 grant, so theit setis was genuinely absent whenreported the grantsame wasway applied.as one that is not there.

Common causes include:

  • The host was rebooted and the sets were never reapplied.recreated. nftables sets live in the kernel ruleset and do not persist across a reboot on their own
  • A firewall service reloaded and flushed the ruleset. A stock /etc/nftables.conf opens with flush ruleset, which removes tables it does not itself define
  • The set name, table or family inon the knoc does not match what exists on the hosthost. Every part is case-sensitive
The set has auto-merge enabled, so the agent skips it during discovery and Validate reports it missing even though nft list set shows it The set holds something other than plain addresses, such as a concatenated type like ipv4_addr . inet_service. Only ipv4_addr and ipv6_addr sets can be managed The IPv4 field names an ipv6_addr set, or the reverse The set was renamed or deleted on the host after the knoc was configured

Steps to Resolve

Confirm What the Host Actually Has

  1. List every set:set with its definition: sudo nft -j list sets
  2. Compare the family, table and set name against the knoc configuration,knoc, character for character.character
NamesCheck arethe case-sensitivetype line. It must read ipv4_addr for an IPv4 set and ipv6_addr for an IPv6 set

Remove auto-merge From the Set

auto-merge coalesces adjacent elements into ranges, which leaves the agent unable to add and remove grants individually, so it never offers the set. Flags cannot be changed in place, so drop auto-merge from the declaration and recreate the set:

sudo nft delete set <family> <table> <set>
sudo nft -f /path/to/your/sets.nft

Recreating empties the set, so any address currently granted through it is withdrawn until the next grant.

Recreate the Knocknoc Sets

If the default sets are gone:

  1. Run sudo systemctl start create-nft-sets.service to reapply them from /opt/knocknoc-agent/etc/knocknoc-sets.nft
If the unit is not installed, run knocker enable nftables, towhich provisioncreates the defaultsets setsand installs it knocker status nftables lists each declared set and whether it is present in the inetrunning knocknoc table This also installs create-nft-sets.service, which reapplies them at bootruleset

Make the Sets Survive a Reload

create-nft-sets.service deliberately orders itself AfterAfter=nftables.service nftables.firewalld.service andon firewalld.service.purpose. IfA youunit writethat your own unit, order it the same way. Runningruns before those services meanshas its table wiped by the stock config's flush ruleset wipesmoments later. If you declare the tablesets straightin your own file instead, apply it after youanything createthat it.flushes.

Check for a Competing Firewall Manager

firewalld, shorewall-nft and similar tools rewrite the ruleset on reload. If one of them owns the ruleset on this host, placekeep the Knocknoc set in a table that tool does not flush, or reapply the set onfrom itsthat tool's own reload hook.

Back to top