Search guides

Fix nftables that will not load

We'll check the error, validate the ruleset, fix syntax, and load—or tell you when to escalate.

Troubleshooting · Servers & Linux
10–20 min
What you'll need
  • SSH or console access with root or sudo
  • The nftables rules file path (often /etc/nftables.conf)
Step 1 of 5

Quick triage — pick your path

Quick triage — pick your path

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Check the error, validate the ruleset, fix syntax, and load.

  • Run sudo nft -f /etc/nftables.conf (or your rules file). Note the error.
  • Good: You see an error message. Proceed to Validate ruleset.
  • Bad: No error—check nft list ruleset; rules may already be loaded.

Validate ruleset

Goal: Check syntax without loading.

  • Run sudo nft -c -f /etc/nftables.conf. The -c flag validates only.
  • Good: No output—syntax is valid. Proceed to Load rules.
  • Bad: Error shown—proceed to Fix syntax.

Fix syntax

Goal: Fix the reported syntax errors.

  • Common issues: missing semicolons, wrong table/chain names, invalid expressions.
  • Check that tables and chains are created before rules reference them.
  • Good: nft -c -f passes. Proceed to Load rules.
  • Bad: If includes are used, validate each included file.

Load rules

Goal: Load the rules and enable the service.

  • Run sudo nft -f /etc/nftables.conf. Then sudo nft list ruleset to confirm.
  • Run sudo systemctl enable nftables and sudo systemctl start nftables.
  • Good: Rules load and service is active.
  • Bad: Check iptables conflict—flush iptables first if needed.

When to escalate

Escalate if:

  • The system is managed by config management.
  • You cannot run nft (permission denied).
  • The ruleset is generated by another tool (Puppet, Ansible).

Provide nft -c -f output and the rules file.

Verification

  • sudo nft list ruleset shows your rules.
  • sudo systemctl status nftables shows active.
  • Rules persist across reboot (service enabled).

Escalation ladder

Work from the device outward. Stop when the problem is fixed.

  1. Check error Run nft -f <file> or systemctl status nftables.
  2. Validate nft -c -f <file> to check syntax.
  3. Fix syntax Fix semicolons, table/chain names, expressions.
  4. Load and enable nft -f <file>; systemctl enable --now nftables.

What to capture if you need help

Before calling support or posting for help, have these ready. It speeds everything up.

  • nft -c -f output or error message
  • Rules file path and contents
  • Steps already tried

What error does nft show?

Run sudo nft -f /etc/nftables.conf or systemctl status nftables.

Run `sudo nft -f /etc/nftables.conf`. Syntax error: run `nft -c -f /etc/nftables.conf` to validate and get line number. Permission denied: escalate. No error: rules may have loaded—check nft list ruleset.

Yes No error

You can change your answer later.

Validate the ruleset

nft -c -f checks syntax.

Run `sudo nft -c -f /etc/nftables.conf`. Valid: no output—try loading again; check iptables conflict. Invalid: fix the reported line. Common: missing semicolons, wrong table/chain names.

Yes No

You can change your answer later.

Fix syntax errors

Edit the rules file. Add semicolons. Check table and chain names match. Ensure chains are created before rules. Re-run nft -c -f until valid.

Done

Load rules

`sudo nft -f /etc/nftables.conf`. If success, `sudo nft list ruleset` to confirm. Enable service: `systemctl enable --now nftables`.

Done

Check if rules are loaded

Run `sudo nft list ruleset`. If rules appear, nftables is working. If service fails, check the unit file for config path.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Why would nftables fail to load?
Syntax errors in the ruleset, conflicting iptables rules, or the rules file path is wrong. Run nft -c -f <file> to validate.
Can I fix nftables not loading myself?
Yes. Validate with nft -c -f <file>, fix syntax errors, and reload. Check that iptables is not conflicting.
When should I escalate nftables not loading?
If the system is managed by config management, you lack root, or the ruleset is generated by another tool.

Rate this guide

Was this helpful?

Continue to