Network Lock unavailable on some Linux (e.g. Fedora >42)

On some Linux systems, Network Lock cannot be used because another program owns one or more nftables tables. Eddie then disables every Network Lock mode: it cannot manage the system firewall in a safe and reversible way.

This is common on distributions that run firewalld with its default nftables backend (for example Fedora 42 and newer).

What you see

At startup, Eddie logs a message similar to:

> Network Lock unavailable: nftables table(s) … owned by another program. (With firewalld, set NftablesTableOwner=no in /etc/firewalld/firewalld.conf and restart the service.)

If Network Lock is required when a VPN session starts (the default), connection fails with:

> There is no available or enabled Network Lock mode, sorry.

In Preferences, no Network Lock mode is listed as available.

Why

nftables can mark a table with the owner flag. Only the process that created that table is allowed to change it. Programs such as firewalld often create their table that way (NftablesTableOwner=yes by default).

Eddie Network Lock needs to back up and restore firewall rules. Owned tables break that model, so Eddie disables Network Lock entirely when it detects them.

Fix with firewalld (recommended if you want Network Lock)

  1. Edit /etc/firewalld/firewalld.conf.
  2. Set:
NftablesTableOwner=no
  1. Restart firewalld, for example:
sudo systemctl restart firewalld
  1. Restart Eddie.

After that, Network Lock modes should appear again and work as usual.

Connect without Network Lock

If you prefer to leave firewalld ownership unchanged, turn off the requirement that Network Lock stay active during the session:

  • Preferences → Network Lock: disable If Network Lock must be active during session

(option netlock.connection).

Eddie can then connect without activating Network Lock. Traffic protection from Network Lock will not apply for that session.

You can also set Network Lock Mode to None, with the same effect for Network Lock itself.

Notes

  • The check runs when Eddie initializes Network Lock. Fix firewalld (or stop the owning program), then restart Eddie.
  • The same ownership conflict can involve programs other than firewalld; the firewalld setting above only applies when firewalld is the owner.
  • Related overview: Network Lock.