Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop wasting time tracing packets that drop into a black hole

🧩 The Challenge

Dealing with a service that refuses to talk to an external API despite the firewall policy looking perfectly fine is a special kind of hell. You end up staring at your iptables rules for an hour, only to realize you were looking in the wrong table the whole time.

💡 The Fix

Use the trace feature in nftables to watch individual packets hit your rules in real-time. It’s like having a debugger for your network stack that shows you exactly which line kills the traffic.

nft add rule ip filter output tcp dport 443 meta nftrace set 1
nft monitor trace

⚙️ Why It Works

Setting the nftrace flag on a specific packet tells the kernel to send netlink events for every single rule that packet touches. It stops you from guessing where your traffic is getting nuked and shows you the actual chain rejection.

🚀 Pro-Tip: Don’t forget to delete that trace rule once you’re done, or you’ll flood your own logs and tank performance.

Linux Tips & Tricks | © ngelinux.com | 11/1/2026