Compared to working with iptables, nftables is like this haiku: Multiple IP protocols Service names for ports Chains happy Sacred connection tracking

Compared to working with iptables, nftables is like this haiku: Multiple IP protocols Service names for ports Chains happy Sacred connection tracking Automatically available for me Configuration bliss BPF may be future But time is only now lo accept That is to say, I don't think bpfilter is ready yet, but nftables is already great compared to most firewalls short of PF. (With apologies to Jason Dixon and his PF haiku: https://marc.info/?l=openbsd-pf&m=108507584013046&w=2 https://marc.info/?l=openbsd-pf&m=108507584013046&w=2 )