Linux networking: routing and the nftables firewall

The company switched Internet providers two days ago. Since then, customers can no longer track their containers online, while at the office the portal displays perfectly. The provider answered your ticket within an hour: the problem is not on their side. Management gives you the morning to give customers their portal back, and to answer one question in writing: who was right? You start by narrowing down the outage instead of searching at random: the same test from the office and from the Internet rules out half the suspects. Then a packet capture settles the argument with the provider, with evidence. You then go down layer by layer: the address, the route, the neighbours, and a gateway that has not existed since the router was replaced. You learn to recognise, from the shape of the error alone, a service that is not listening from a firewall that filters, and you catch the firewall in the act in the kernel log. The lab goes where tutorials stop. Understanding why a rule that was wrong from day one worked for years. Opening exactly one port in nftables, without opening administration to the Internet or shutting out the office. Then making every fix permanent, and proving it without rebooting, before writing the incident report that management and the provider will read. The office, the provider's router and a customer on the Internet are simulated on the machine: you can break the route and the firewall without losing your terminal. At the end, the server's state and your report are checked, and the result counts for your ranking.