Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Trace your packet path without losing your mind

🧩 The Challenge

Dealing with a connection that works from one subnet but dies from another is a special kind of hell. You spend hours checking rules and wondering if the packet is even hitting the wire.

💡 The Fix

Use the TRACE feature in nftables to log every single chain evaluation for a specific flow. It turns the “is it the firewall or not” guessing game into a simple log reading exercise.

nft add rule ip filter input ip saddr 192.168.1.50 meta nftrace set 1
tail -f /var/log/kern.log | grep nftables

⚙️ Why It Works

By setting the trace bit on specific packets, the kernel pipes every decision made by your rulesets directly into the system log. You can literally watch your packet traverse the rules until it gets dropped or accepted.

🚀 Pro-Tip: Don’t forget to delete the trace rule immediately after you’re done, or your logs will become unusable garbage in about five minutes.

Linux Tips & Tricks | © ngelinux.com | 11/6/2026