> As a systemd hater, I have to say that I like the systemd approach here better than messing with iptables. The locality of behavior is nice. Until someone ne

> As a systemd hater, I have to say that I like the systemd approach here better than messing with iptables. The locality of behavior is nice. Until someone new comes along and is not aware of this seemingly obscure feature and can't figure why traffic is not getting to the app: nothing in iptables, tcpdump shows the packets getting to the system… WTF? Looking at a service's systemd unit file would be the last place I would think for network filtering configuration. Or does systemd place the appropriate lines into iptables (or nftables nowadays) on your behalf?