iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If a Linux firewall service is active but iptables -L appears empty, do not assume the host is unprotected. Modern systems may be enforcing policy through nftables, while firewalld or ufw provides the management interface. Start with the kernel’s complete ruleset: sudo nft list ruleset. Then identify the service that owns the configuration and compare its view with the kernel output.
The checks below distinguish the management layer from the packet-filtering rules actually installed in the kernel. They also account for IPv4 versus IPv6, firewalld runtime versus permanent configuration, direct rules, and chains added by containers or virtualization software.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Why an active firewall can show no iptables rules
iptables -L is only one view of firewall policy. On a current Linux distribution, it may be a legacy interface or a compatibility command while the active policy is represented by nftables. If firewalld is using its nftables backend, the rules enforcing traffic may not appear in a legacy iptables listing.
There are several separate layers to keep straight:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Kernel enforcement: nftables tables, chains, rules, counters, and hooks currently loaded into the kernel.
- Firewall manager: firewalld, ufw, or another service that creates and maintains policy.
- Address family: IPv4 and IPv6 can have different rules and may be managed through separate commands.
- Configuration state: firewalld keeps a runtime configuration and a permanent configuration; they can differ.
- Additional software: containers, virtual machines, bridges, and security tools can add their own chains or hooks.
That is why an empty legacy listing is not, by itself, evidence that no firewall policy exists.
The authoritative first check: inspect the kernel ruleset
Run this command with root privileges:
sudo nft list rulesetThis prints the nftables ruleset loaded in the kernel, including tables, chains, rules, and counters. It is the most useful starting point when iptables -L does not explain the behavior you observe. Save the output before changing anything, especially on a remote machine.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If the command returns a substantial ruleset, the host is enforcing nftables policy even if the legacy iptables view is empty. Read the table and chain names, look for input, output, forward, and prerouting hooks, and note any counters that increase when you generate test traffic.
If sudo nft list ruleset is empty as well, the active service may be using another mechanism, may have failed to load its policy, or may only be managing rules in a different namespace. Continue with the service checks rather than flushing or restarting services blindly.
Step 1: identify which firewall manager is active
Check the common services individually. A service may not be installed, so an error for a missing unit is different from a service that is installed but stopped.
systemctl is-active firewalld
systemctl is-active ufw
systemctl is-active nftablesUse the result to decide which management commands to run next. Do not infer ownership from a package name alone: a host can contain more than one firewall utility, while only one service may currently be loading policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check firewalld directly
When firewalld is installed, ask the daemon whether it is running:
sudo firewall-cmd --stateA running daemon prints running. The command also returns a status code that scripts can use to distinguish a running daemon from one that is unavailable. This confirms the service state, not the complete kernel ruleset.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Check active zones and interface bindings
Firewalld applies zone policy according to interface and, in some configurations, source bindings. Display the active bindings with:
sudo firewall-cmd --get-active-zonesThe output identifies each active zone and the interfaces or sources assigned to it. If you inspect the wrong zone, you can conclude incorrectly that a service or port is missing.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsStep 2: inspect each firewalld zone
For every zone shown by --get-active-zones, display its policy:
sudo firewall-cmd --zone=<zone> --list-allReplace <zone> with the actual zone name, such as the zone displayed by the previous command. The output can include the target, interfaces, sources, services, ports, protocols, masquerading, forwarding, and rich rules associated with that zone.
You can also inspect the default zone with:
sudo firewall-cmd --list-allThat command is useful for orientation, but it is not a substitute for checking every active zone. A non-default zone may be bound to the interface carrying the traffic you are testing.
Runtime and permanent firewalld configurations
Firewalld maintains separate runtime and permanent environments. Runtime changes take effect immediately but can disappear when the daemon reloads or restarts. Permanent changes are stored for future activation and may not affect current traffic until a reload.
Free tools Windows power users keep installed
One-click scans. No signup required.
When diagnosing a mismatch, determine which environment contains the rule. A rule visible only in the runtime configuration can vanish after a reload. A rule saved only in the permanent configuration may not appear in the active runtime policy yet.
Use the appropriate firewalld commands for the specific property you are checking, and compare the state before and after a reload only when you have console access or another recovery path. If you intentionally want to save current runtime changes, the command is:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo firewall-cmd --runtime-to-permanentRun it only when the runtime policy is known to be correct. It copies the current runtime configuration into the permanent configuration; it is not a harmless inspection command.
Step 3: inspect ufw when it is installed
On Ubuntu systems where ufw is installed, use its own status view:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo ufw status verboseUbuntu’s security documentation describes ufw as a firewall framework that acts as a frontend for both iptables and nftables. Its status output therefore represents the policy as ufw understands it, while sudo nft list ruleset shows what is currently loaded in the kernel.
Compare both outputs. If ufw reports an active policy but the legacy iptables listing is empty, nftables may be the backend carrying the rules. If ufw reports inactive and nftables still contains rules, another manager or software component may have installed them.
Step 4: check both IPv4 and IPv6 views
A test performed over IPv6 is not explained by an IPv4-only listing. Check the compatibility views for both families:
sudo iptables -S
sudo ip6tables -SThe -S form prints rules in command syntax and is often easier to compare or save than a formatted packet-and-byte listing. These commands remain compatibility or legacy views; always compare them with sudo nft list ruleset when nftables is involved.
Firewalld can manage IPv4, IPv6, Ethernet bridges, and IP sets. An interface or zone can therefore have behavior that is not obvious from an IPv4 iptables command alone. Confirm the address family used by your test connection before deciding that a rule is absent.
Step 5: account for multiple hooks and independent chains
With an nftables-backed firewalld configuration, packet processing can involve more than one hook. Firewalld’s direct-rule documentation warns that a packet accepted by a direct iptables rule can still be processed by the nftables ruleset. An apparent ACCEPT in one layer is not necessarily the final decision.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Containers, virtualization platforms, bridge networking, and other security software can also install their own tables, chains, or hooks. The complete nftables output is where these additions become visible. Look for unfamiliar table names, forward-chain rules, bridge-related hooks, and rules that reference virtual interfaces.
When tracing a connection, record the interface, protocol, address family, source and destination ports, and direction. Then locate rules that match those attributes and watch their counters while making one controlled test connection. A rule whose counters never change may belong to a different interface, family, zone, or hook than the traffic you are testing.
Recommended Free Tools
How to reconcile the different command outputs
| View | What it represents | Useful command | Common limitation |
|---|---|---|---|
| Kernel enforcement | Rules currently loaded into nftables, including tables, chains, hooks, and counters | sudo nft list ruleset |
Does not explain which manager or configuration file created each rule |
| Legacy IPv4 compatibility | Rules exposed through the iptables command for IPv4 | sudo iptables -S |
Can omit policy implemented directly through nftables |
| Legacy IPv6 compatibility | Rules exposed through the ip6tables command for IPv6 | sudo ip6tables -S |
Does not replace an nftables inspection |
| Firewalld daemon state | Whether firewalld is running | sudo firewall-cmd --state |
Shows service state, not every active kernel rule |
| Firewalld zone bindings | Zones attached to interfaces or sources | sudo firewall-cmd --get-active-zones |
Does not list the complete policy for each zone |
| Firewalld zone policy | Services, ports, targets, forwarding, masquerading, and other zone settings | sudo firewall-cmd --zone=<zone> --list-all |
Must be run for every active zone and considered separately for runtime and permanent state |
| Ufw management view | Rules as represented by the ufw frontend | sudo ufw status verbose |
Must be reconciled with the nftables ruleset and any other manager |
Use the management-layer commands to understand intent and the kernel view to verify enforcement. Neither view alone answers every question.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mismatch scenarios and what they mean
Firewalld is running, but iptables is empty
This is commonly explained by firewalld using its nftables backend. Check sudo nft list ruleset, then inspect active zones and each zone’s policy. If the nftables output contains the expected chains and rules, the empty legacy listing is a viewing mismatch rather than proof of a disabled firewall.
Ufw reports rules, but iptables does not
Ufw can operate as a frontend for both iptables and nftables. Compare sudo ufw status verbose with sudo nft list ruleset. The latter is the decisive check for rules currently installed in the nftables kernel path.
The service is active, but the nftables ruleset is empty
Verify that the service you checked is the service responsible for loading policy. A running daemon can have no configured rules, can be managing a different backend, or can have failed to apply its configuration. Check the manager’s own status and zone or policy output, then inspect service logs through your normal system administration process before making changes.
A rule appears after adding it, then disappears
Determine whether it was added to firewalld’s runtime environment only. Runtime-only changes can be replaced by a reload or restart. If the rule is intended to survive those events, save it in the permanent configuration using the appropriate firewalld configuration procedure. Do not use --runtime-to-permanent until you have reviewed the complete runtime policy.
An ACCEPT rule does not make the connection work
Check whether the packet is traversing another nftables hook, a different address family, a bridge or forwarding path, or a chain installed by other software. Firewalld’s direct-rule caveat specifically means an accepted direct iptables rule can still encounter nftables processing. Review the full ruleset and counters instead of stopping at the first matching-looking rule.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
A safe diagnostic procedure for remote hosts
Firewall troubleshooting can disconnect you from a server. Do not flush rules while diagnosing a remote host. A flush removes policy without proving which service should recreate it, and a lost SSH session may leave you without a recovery path.
- Save evidence first. Capture
sudo nft list ruleset,sudo iptables -S,sudo ip6tables -S, firewalld zone output, and ufw status when applicable. - Record the connection details. Note whether your session uses IPv4 or IPv6, the destination interface, and the protocol and port being tested.
- Identify ownership. Check the active services and determine whether firewalld, ufw, nftables, or another component is maintaining policy.
- Test from a separate system. If possible, use an independent host so you can distinguish a client-side failure from a server-side firewall decision.
- Change one setting at a time. Make a narrowly scoped rule change, test it, and save the resulting outputs before proceeding.
- Keep console access available. Use an out-of-band console or a second administrative session before applying changes that could affect remote access.
These precautions preserve the information needed to restore a known-good policy and reduce the chance of locking yourself out.
What to save for a useful incident record
A reproducible record should include the command, timestamp, address family, and interface involved. Save:
sudo nft list ruleset, including counters before and after a controlled test.sudo iptables -Sandsudo ip6tables -S.sudo firewall-cmd --stateandsudo firewall-cmd --get-active-zoneswhen firewalld exists.sudo firewall-cmd --zone=<zone> --list-allfor every active zone.sudo ufw status verboseon systems using ufw.- The result of the relevant
systemctl is-activechecks.
Keeping these outputs together makes it possible to compare the manager’s intended policy with the kernel’s actual rules and to identify changes caused by a reload, restart, package update, or networking component.
A compact command checklist
# Kernel ruleset: tables, chains, hooks, rules, and counters
sudo nft list ruleset
# Legacy or compatibility views
sudo iptables -S
sudo ip6tables -S
# Service ownership and firewalld state
systemctl is-active firewalld
systemctl is-active ufw
systemctl is-active nftables
sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-all
# Inspect each active firewalld zone
sudo firewall-cmd --zone=<zone> --list-all
# Ufw status on systems where it is installed
sudo ufw status verbose
# Save runtime firewalld changes only when you intend to make them permanent
sudo firewall-cmd --runtime-to-permanentRun the final command only after reviewing the runtime configuration. It is a state-changing operation, unlike the other inspection commands.
What you should conclude from an empty iptables listing
An empty iptables -L output is a prompt to inspect the correct backend, not a final security assessment. The decisive sequence is: identify the active manager, inspect sudo nft list ruleset, check both IPv4 and IPv6 compatibility views, map interfaces to firewalld zones when applicable, compare runtime and permanent state, and account for independent hooks installed by other software.
Once those layers agree, you can tell whether the firewall is enforcing the policy you intended, whether a rule exists only temporarily, and which component must be changed to correct the behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
