I was trying to block VNC port 5901 from internet but accessible from localhost. I have a docker container running on the server, which works fine. After the following 2 commands, I still can access my VNC port from remote. What did I do wrong? Thanks in advance.

sudo nft add chain filter INPUT

sudo nft add rule ip filter INPUT ip saddr != tcp dport 5901 drop

Here is the rules output

  • 1
    Ugh, another poinless image. Commented Feb 21, 2022 at 17:29

1 Answer 1


The tables are fine. However, unlike ipfw, it won't be activated by the following command:

sudo systemctl start nftables

  • Please use the edit link on your question to add additional information. The Post Answer button should be used only for complete answers to the question. - From Review Commented Sep 11, 2022 at 3:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .