I have always found Linux's iptables particularly baroque when compared with OpenBSD's pf -- the different chains (INPUT, FORWARD, OUTPUT), the different tables

I have always found Linux's iptables particularly baroque when compared with OpenBSD's pf -- the different chains (INPUT, FORWARD, OUTPUT), the different tables ("Oh, it's the _NAT_ table you're looking for"), they seemed unnecessary complexities. My current firewall [0] has two physical interfaces, 3 additional "virtual" (VLAN-tagged) interfaces, three RFC-1918 subnets, four IPv6 subnets (dual-stack of course, except for an IPv6-only subnet) with varying degrees of security between the subnets -- and I could not imagine maintaining it with anything but pf. [0] https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.conf https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.co...