I tried what you said. I sent a ping from my computer to the server and this was the output of nft monitor trace: trace id 1d01c81e ip ping_trace prerouting packet: iif "eth0" ether saddr b0:7d:64:e8:8f:3c ether daddr d8:3a:dd:de:28:99 ip saddr 192.168.40.201 ip daddr 192.168.40.203 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 65074 ip length 84 icmp type echo-request icmp code 0 icmp id 35586 icmp sequence 0 trace id 1d01c81e ip ping_trace prerouting rule icmp type { echo-reply, echo-request } meta nftrace set 1 (verdict continue) trace id 1d01c81e ip ping_trace prerouting policy accept trace id 1d01c81e inet filter input conntrack: ct direction original ct state new ct id 271120081 trace id 1d01c81e inet filter input packet: iif "eth0" ether saddr b0:7d:64:e8:8f:3c ether daddr d8:3a:dd:de:28:99 ip saddr 192.168.40.201 ip daddr 192.168.40.203 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 65074 ip protocol icmp ip length 84 icmp type echo-request icmp code 0 icmp id 35586 icmp sequence 0 trace id 1d01c81e inet filter input rule ip protocol icmp icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } accept comment "Accept ICMP" (verdict accept) I sort of get what’s happening and it looks like the ping request has been accepted. From my computer when I send a ping it shows: 15:55 dell:/tmp/ $ ping -c1 192.168.40.203 PING 192.168.40.203 (192.168.40.203): 56 data bytes --- 192.168.40.203 ping statistics --- 1 packets transmitted, 0 packets received, 100% packet loss So even though it’s being accepted, I still get nothing going back to my computer, at least that’s how I understand it.