Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop letting your firewall rules hide in plain sight

🧩 The Challenge

Dealing with a production outage when you know the packets are hitting the box but the application isn’t seeing them is soul-crushing. You end up scrolling through massive chains of rules just to find that one specific reject hidden in the middle.

💡 The Fix

Use the counter flag to see exactly which rules are getting hit by traffic in real-time. It’s the easiest way to prove your theory that a specific rule is nuking your production traffic.

nft list ruleset -a

⚙️ Why It Works

Adding that little -a flag forces the kernel to print out the handle for every single rule. Because you have handles now, you can pinpoint exactly which rule is dropping your packets without needing to guess.

🚀 Pro-Tip: Pipe that output into grep if you are dealing with a massive table to save your sanity.

Linux Tips & Tricks | © ngelinux.com | 8/25/2026