WIUNIX ACADEMY

Atomic nftables changes: rehearse timeout rollback before risking remote access

Page 4 of 4. Review the earlier steps and prerequisites before continuing.

YOUR SYSTEM. YOUR STEPS.

Where are you working?

Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.

Rocky Linux 9Reviewed against official documentation · 2026-11-05

USE YOUR OWN VALUES

Configure this tutorial

Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.

Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.

Set values for my environment8 editable values

LET’S BUILD

Stop only the fixture timers and remove the empty namespaces

After reviewing the restore evidence, stop the two timer/service pairs created by this lesson. This prevents a late restore from racing namespace removal. The namespace PID lists must be empty before deletion; if they are not, identify the exact lab process and let it finish rather than killing every namespace process.

Delete only the two fresh namespace names. Their veth link disappears with them. The root-only evidence directory remains for review; remove its known files later through your normal lab cleanup process. If creation stopped partway, inspect which exact objects exist and skip only their absent counterparts deliberately; do not weaken collision guards or delete unrelated namespaces.

Terminal on the disposable lab VM

sudo systemctl stop 'academy-nft-rollback.timer' 'academy-nft-rollback.service' || exit 1
sudo systemctl stop 'academy-nft-rollback-rehearsal.timer' 'academy-nft-rollback-rehearsal.service' || exit 1
systemctl show 'academy-nft-rollback.timer' 'academy-nft-rollback.service' -p Id -p ActiveState -p SubState
server_pids=$(sudo ip netns pids 'academy-nft-server') || exit 1
client_pids=$(sudo ip netns pids 'academy-nft-client') || exit 1
printf 'server namespace PIDs: %s\nclient namespace PIDs: %s\n' "$server_pids" "$client_pids"
test -z "$server_pids" || exit 1
test -z "$client_pids" || exit 1
sudo ip netns del 'academy-nft-server' || exit 1
sudo ip netns del 'academy-nft-client' || exit 1
sudo ip netns list

How do I know it worked?

Only this lesson’s timers are stopped and its two namespaces are gone; host firewall and application services are preserved.

Keep the claims as narrow as the evidence

Record the actual VM/kernel/nft/systemd versions, the known-good probe, candidate drop, detached timer result, restored table and successful fresh probe. This tutorial provides documentation-reviewed commands and a reproducible lab design; it does not claim the lab ran on every listed distribution or that your SSH policy is safe.

For a real deployment, keep the reviewed policy source, manager ownership, console path, timeout limits, acceptance evidence and persistent recovery plan together. Atomic application protects a transaction boundary; successful connectivity and operational recovery still need their own evidence.

GO TO THE SOURCE

Official references

Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.

KEEP LEARNING

Your next step

Explore all tutorials ↗

Where are you working?

Configure this tutorial

Stop only the fixture timers and remove the empty namespaces

Keep the claims as narrow as the evidence

Official references

Your next step

Fail2ban for Nginx: trustworthy logs, scoped bans and recovery

Why is your Docker port open when UFW says it is blocked?

Reliable systemd timers: missed runs, repeatable jobs and completion intervals