Nftables service is not running

Support
,
1

What type of hardware are you using: VPS bought online
What YunoHost version are you running: 12.1.39
How are you able to access your server: The webadmin
SSH
Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: No

Describe your issue

Nftables is not running. It’s possibly been broken for a long time, i only just found out… I think since last upgrade two months ago.
When i try to start the service, i have the following error message :

Erreur: "500"
Action: "PUT" /yunohost/api/services/nftables/start

avril 12 21:28:21 nft[3916833]:         udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
avril 12 21:28:21 nft[3916833]:                                                    ^^^^^^^^^^^^^^^^^^^^^^^
avril 12 21:28:21 nft[3916833]: In file included from /etc/nftables.conf:20:1-33:
avril 12 21:28:21 nft[3916833]: /etc/nftables.d/yunohost-firewall.conf:18:52-74: Error: Could not process rule: No such file or directory
avril 12 21:28:21 nft[3916833]:         udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
avril 12 21:28:21 nft[3916833]:                                                    ^^^^^^^^^^^^^^^^^^^^^^^
avril 12 21:28:21 nft[3916833]: In file included from /etc/nftables.conf:20:1-33:
avril 12 21:28:21 nft[3916833]: /etc/nftables.d/yunohost-firewall.conf:18:9-139: Error: Could not process rule: No such file or directory
avril 12 21:28:21 nft[3916833]:         udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
avril 12 21:28:21 nft[3916833]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
avril 12 21:28:21 nft[3916833]: In file included from /etc/nftables.conf:20:1-33:
avril 12 21:28:21 nft[3916833]: /etc/nftables.d/yunohost-firewall.conf:19:51-111: Error: Could not process rule: Operation not supported
avril 12 21:28:21 nft[3916833]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
avril 12 21:28:21 nft[3916833]:                                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
avril 12 21:28:21 nft[3916833]: In file included from /etc/nftables.conf:20:1-33:
avril 12 21:28:21 nft[3916833]: /etc/nftables.d/yunohost-firewall.conf:19:51-111: Error: Could not process rule: No such file or directory
avril 12 21:28:21 nft[3916833]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
avril 12 21:28:21 nft[3916833]:                                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
avril 12 21:28:21 nft[3916833]: In file included from /etc/nftables.conf:20:1-33:
avril 12 21:28:21 nft[3916833]: /etc/nftables.d/yunohost-firewall.conf:19:9-176: Error: Could not process rule: No such file or directory
avril 12 21:28:21 nft[3916833]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
avril 12 21:28:21 nft[3916833]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
avril 12 21:28:21 systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
avril 12 21:28:21 systemd[1]: nftables.service: Failed with result 'exit-code'.
avril 12 21:28:21 systemd[1]: Failed to start nftables.service - nftables.

Since the error comes from the /etc/nftables.d/yunohost-firewall.conf file, i tried to re-generate it with the webadmin GUI for the Firewall (basically i just toggled a port open) and this task failed too.
The logs for this action can we found here : https://paste.yunohost.org/raw/uzumexocep

The system is up to date and i did not temper with nftables, so i have no idea what went wrong… I did restart the server just in case, but no help. Any idea ?

Share relevant logs or error messages

https://paste.yunohost.org/raw/uzumexocep

2

See

systemctl status nftables.service

And

journalctl -xeu nftables.service

For details.

Try

systemctl reload nftables
3

Hello, thank you for your help ! Here are the logs :

root@yuno:~# systemctl status nftables.service
× nftables.service - nftables
     Loaded: loaded (/lib/systemd/system/nftables.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/nftables.service.d
             └─yunohost-nftables-hooks.conf
     Active: failed (Result: exit-code) since Sun 2026-04-12 21:54:15 UTC; 17h ago
       Docs: man:nft(8)
             http://wiki.nftables.org
    Process: 562 ExecStartPre=/usr/share/yunohost/yunohost-nftables-hooks pre (code=exited, status=0/SUCCESS)
    Process: 588 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=1/FAILURE)
   Main PID: 588 (code=exited, status=1/FAILURE)
        CPU: 117ms

Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:19:51-111: Error: Could not proce>
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0>
Apr 12 21:54:15 yuno.ondin.es nft[588]:                                                   ^^^^^^^^^^^^^^^^^^^^^^>
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:19:9-176: Error: Could not proces>
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0>
Apr 12 21:54:15 yuno.ondin.es nft[588]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^>
Apr 12 21:54:15 yuno.ondin.es systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Apr 12 21:54:15 yuno.ondin.es systemd[1]: nftables.service: Failed with result 'exit-code'.
Apr 12 21:54:15 yuno.ondin.es systemd[1]: Failed to start nftables.service - nftables.
lines 1-22/22 (END)

And :

root@yuno:~# journalctl -xeu nftables.service
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:15:9-43: Error: Could not process rule: No such file or directory
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp dport $udp_ports counter accept;
Apr 12 21:54:15 yuno.ondin.es nft[588]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:18:52-74: Error: Could not process rule: Operation not supported
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port>
Apr 12 21:54:15 yuno.ondin.es nft[588]:                                                    ^^^^^^^^^^^^^^^^^^^^^^^
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:18:52-74: Error: Could not process rule: No such file or directory
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port>
Apr 12 21:54:15 yuno.ondin.es nft[588]:                                                    ^^^^^^^^^^^^^^^^^^^^^^^
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:18:9-139: Error: Could not process rule: No such file or directory
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port>
Apr 12 21:54:15 yuno.ondin.es nft[588]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:19:51-111: Error: Could not process rule: Operation not supported
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets>
Apr 12 21:54:15 yuno.ondin.es nft[588]:                                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:19:51-111: Error: Could not process rule: No such file or directory
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets>
Apr 12 21:54:15 yuno.ondin.es nft[588]:                                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Apr 12 21:54:15 yuno.ondin.es nft[588]: In file included from /etc/nftables.conf:20:1-33:
Apr 12 21:54:15 yuno.ondin.es nft[588]: /etc/nftables.d/yunohost-firewall.conf:19:9-176: Error: Could not process rule: No such file or directory
Apr 12 21:54:15 yuno.ondin.es nft[588]:         udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets>
Apr 12 21:54:15 yuno.ondin.es nft[588]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^>
Apr 12 21:54:15 yuno.ondin.es systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ An ExecStart= process belonging to unit nftables.service has exited.
░░ 
░░ The process' exit code is 'exited' and its exit status is 1.
Apr 12 21:54:15 yuno.ondin.es systemd[1]: nftables.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ The unit nftables.service has entered the 'failed' state with result 'exit-code'.
Apr 12 21:54:15 yuno.ondin.es systemd[1]: Failed to start nftables.service - nftables.
░░ Subject: A start job for unit nftables.service has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit nftables.service has finished with a failure.
░░ 
░░ The job identifier is 271 and the job result is failed.
lines 99-148/148 (END)

Finally :

root@yuno:~# systemctl reload nftables
nftables.service is not active, cannot reload.
root@yuno:~# systemctl start nftables
Job for nftables.service failed because the control process exited with error code.
See "systemctl status nftables.service" and "journalctl -xeu nftables.service" for details.

So I understand this is a config issue, however i’m confused because this is the config file provided by Yunohost. As stated, when i try to regenerate it, the job fails.

4

Try:

lsmod | grep nft
5

Uh, sorry, it does not show anything :confused:

root@yuno:~# lsmod | grep nft
root@yuno:~# lsmod
Module                  Size  Used by
root@yuno:~#
6

Probably updated your system (updating the kernel too).
The nft kernel module cannot be loaded, have you tried restarting your server to the previous kernel version?

7

I will investigate the kernel update, i’ll let you know how that went !

8

Hello there, i found a topic that helped me solve it : Nftables.service: nftables was skipped because of an unmet condition check - #14 by Cyril

TLDR : outdated kernel version, needs extra step to update on Kimsufi servers, but once solved nftables was running again.

4 Likes
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.