KnowledgeBase   →   nftables needs manual restart after to start network routing

Possible solutions:

• AppArmor may be interfering, and if configuration fails then removal requires multiple steps (a reboot is required to completely remove AppArmor's lingering effects):

  aa-teardown
  systemctl stop apparmor
  systemctl disable apparmor
  systemctl purge apparmor
  reboot

  Some updates or Operating System upgrades may result in AppArmor being re-enabled automatically. You should add a note to your update/upgrade procedures to check for this if not using AppArmor is preferred.

• If UFW (uncomplicated firewall) is installed, it may be conflicting with nftables during boot. In this case, disabling UFW resolves the problem when nftables is the preferred firewall solution:

  systemctl stop ufw
  systemctl disable ufw
  systemctl enable nftables
  systemctl restart nftables

  Rebooting to confirm that this resolves the problem is recommended.

• If one or more network adapters is slow to become active, it may be the case that nftables can't start because the network adapter isn't available. In this case, the solution is to:
  1. edit the /etc/nftables.conf file
  2. change iif references for late-to-become-active network adapters to iifname
  3. change oif references for late-to-become-active network adapters to oifname

  This change may result in slightly lower performance in certain scenarios, so it's normally recommended to only use this for network adapaters at are slow to become active or may be unavailable for long durations.

  Rebooting to confirm that this resolves the problem is recommended.