networking

Three biases decide most calls:

• Evaluation order belongs to the engine, not the file. nftables runs every base chain on a hook by priority and only drop is final; Caddy sorts directives by a built-in table; nginx discards inherited proxy_set_header the moment one is set lower; Traefik ranks routers by rule length; Authelia and cloudflared take the first match. Read the engine's order before trusting the file's.
• Who is trusted is a list, and every tool ships a different one. Caddy trusts no proxy for X-Forwarded-*, HAProxy and Cloudflare append the client's, Unbound refuses every client but localhost, AdGuard Home on 0.0.0.0 answers the internet, Avahi reflects to every interface, Tailscale on Linux accepts no routes, NetBird pushes them unapproved. Name the list in the config; never assume its direction.
• Every filter has a second path around it. IPv6 beside an ip rule in an inet table; a published container port beside the host input chain; a flowtable beside the later hooks; a reachable origin beside Cloudflare Access; an established connection beside a CrowdSec ban; a default-bridge container beside the LAN resolver. Close the second path or state that it is open.

Filtering

• accept ends only the current base chain; drop ends the ruleset. A permissive table added beside the one Proxmox, Docker, or firewalld installs loads clean and changes nothing. A nat chain at priority -200 or below runs before conntrack and translates nothing.
• ip payload expressions match IPv4 only, also inside inet. ip protocol tcp passes every IPv6 packet; meta l4proto tcp matches both and skips IPv6 extension headers.
• flush ruleset deletes every table on the host, Docker's, firewalld's, and netavark's included, and no daemon notices until restart. flush table <family> <name> is the scoped form. nft -c -f parses; it knows nothing about interface names, runtime-populated sets, or a higher-priority table that drops first.
• A published Docker port never traverses the host input chain; it is DNAT and passes forward. Operator rules go in DOCKER-USER on the iptables backend. Under the nftables backend (Engine 29.0, experimental) there is no DOCKER-USER chain and no jump to it; a daemon switched between backends keeps the stale jump. Engine 28.0 blocks direct-routed access to unpublished ports through the raw table.
• On OPNsense and pfSense the order is floating, then group, then interface, and quick first-match is the default. A rule change does not touch the state table, so a new deny does nothing to a live session until states are reset, and the default deny logs nothing unless told to.

Read [${CLAUDE_SKILL_DIR}/references/filtering.md] when writing or reading an nftables ruleset, a host that also runs Docker, Podman, firewalld, or ufw, or an OPNsense or pfSense rule; it carries the evaluation, loading, coexistence, and appliance rules and the kernel versions each feature needs.