| Everything to the machine is blocked after a change | Policy drop without the ct state established,related accept or service rules you needed | The console; next time use a timed rollback |
| The current SSH session works, new ones don't | The new rules don't allow SSH from you; your session survives only because it's established | Test from a new session before you make a change permanent |
nft -f fails with a syntax error | Typo or unsupported expression; nothing was loaded | The error gives line and column; nft -c -f before loading |
| Office machines can't reach the internet | Forwarding off, no forward accept rule, or no masquerade | sysctl net.ipv4.ip_forward; the forward counter; conntrack -L |
| A port forward doesn't work | DNAT rule not matching (wrong interface or port), or the forward chain doesn't accept it | nft monitor trace with a trace rule; ct status dnat accept in forward |
| Allowed in nftables, still blocked | Another table's chain on the same hook (iptables, Docker) drops it | nft list ruleset (all of it); iptables -L -v -n |
| Rules vanish after a reboot or reload | Added with commands, not in /etc/nftables.conf; or the service isn't enabled | systemctl is-enabled nftables; put changes in the file |
| Docker containers lose networking after a reload | flush ruleset deleted Docker's tables | Replace only your own tables; restart Docker |
| IPv6 stops working | ICMPv6 neighbour discovery not allowed | icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, … } accept |
| No log lines appear | No log rule before the drop, the limit already used up, or (in containers) nf_log_all_netns is 0 | journalctl -k; the rule's position |