Linux nftables Drop: nft list ruleset When ping Works and TCP Dies

Linux / packet path · Techclick CLI troubleshooting lab

ICMP to the VM works. TCP 443 times out. Security group in the cloud is open. The guest has nftables.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Linux / packet path for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Cloud NSG is not the guest firewall. nft list ruleset. A default drop on input explains everything.

Why this ticket shows up

Images often ship with firewalld/nft default deny. Operators debug the cloud layer for an hour.

Symptoms operators actually see

• ICMP ok, TCP dead

• ss shows listen

• nft or iptables default drop

• Works when firewalld is stopped (test only)

CLI first — copy this block

Run these on the Linux / packet path device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

nft list ruleset
iptables -L -n -v
ss -lntp
systemctl status firewalld
tcpdump -nni any port 443

How to read that output

If tcpdump sees SYN and no app ACK, it may still be the app. If tcpdump sees nothing but the cloud delivered, nft dropped it in prerouting/input.

Triage order

1. List nft/iptables

2. Confirm listen socket

3. Allow 443 on input

4. Do not stop firewalld as the permanent fix

5. Retest

Classic traps

What you see	Real cause	Fix
Open the cloud NSG again	Guest firewall is the drop	Fix nft
Disable firewalld forever	You need a rule	Add the service
Blame nginx	SYN never reached it	Watch tcpdump

Proof the ticket is closed

• nft allows 443

• tcpdump shows handshake

• curl from outside works

Say this in an interview

ICMP success never proves TCP. I list the guest firewall before I reopen the cloud NSG.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/