Inventory the existing engine
A host may expose nftables rules through an iptables compatibility frontend. Identify the active rules and the services that restore them before choosing how to make a change. Running two unrelated firewall managers without understanding their ordering can produce surprising results after a reboot.
Keep the access path intact
Save the current rules, then plan the exact addition and removal. Preserve loopback, established traffic and the real SSH port. Populate a new owned chain with the necessary accepts before attaching it to the input path. Avoid flushing shared chains. The smallest rule change is easier to reason about than a broad replacement followed by attempts to reconstruct forgotten exceptions.
Distinguish transport and persistence
A TCP allow does not allow UDP on the same number. Verify the service is listening on the intended protocol, then test from outside the host. Finally, inspect how the rules are restored at boot. A one-time shell command may work perfectly until the next restart, while an obsolete startup helper can quietly reopen a retired service port.
At the terminal
sudo nft list ruleset
sudo iptables-save
sudo ip6tables-save
ss -lntup