NFT053 - nftables Set Cannot Hold a Network

Agent error code #NFT053 occurs when a knoc's predefined source is a network, such as 192.168.100.48/29, and the nftables set the knoc points at was declared without flags interval.

A set without flags interval stores single addresses only, and nft refuses a prefix element on it with "You must add 'flags interval' to your set declaration". The agent reports that refusal under this code. Nothing was added to the set, so the matching revoke has nothing to remove and completes without an error.

Steps to Resolve

Point the Knoc at an Interval Set

Create a set that holds networks and use it on the knoc:

nft add set inet filter knoc_net4 '{ type ipv4_addr; flags interval; }'

Add flags timeout as well if the knoc's grants should carry a kernel-side expiry. Reference the new set from your rules the same way as the existing one, then set it as the knoc's IPv4 (or IPv6) set name. An interval set also holds single addresses, so one set can serve knocs that grant a host and knocs that grant a network.

A set's flags are fixed when it is created. To change an existing set, delete and recreate it, which drops the elements it holds. Active grants are re-applied the next time the agent reconnects.

Check the Existing Set's Flags

On the agent host:

sudo nft list set <family> <table> <set>

A set that can hold a network shows flags interval in its definition.

Or Grant Single Addresses Instead

If the set has to stay as it is, change the knoc's predefined sources to single addresses. A knoc accepts up to five, so a small set of hosts can be listed individually.