I strongly dislike tools like ufw. Whenever I've had to troubleshoot a firewall generated by tools like it, the task is made more difficult by the extraneous ru

I strongly dislike tools like ufw. Whenever I've had to troubleshoot a firewall generated by tools like it, the task is made more difficult by the extraneous rules created by them. I haven't actually used ufw, but reading the docs makes it seem more complicated than most such tools. I would much rather the core management tools become better, rather than more ancillary scripts and generators get stacked up on top; nft seems to be solving it at the right level of abstraction. It is managing a very complex creature (the filtering capabilities of the Linux kernel), so it's representing very complex ideas, but building a basic firewall, or reading the rule set for a basic firewall, is not difficult (in this, or in iptables, though I can see how iptables can seem complicated, if you haven't used it a lot). But, this is definitely more readable for big rule sets than iptables. So...I think this is focused on an easier user interface, in addition to solving a number of technical problems with iptables and paying off some of the technical debt of firewalls in Linux.