ferm is absolutely fantastic, but in my experience, it doesn't always cope well with some more obscure iptables features; I've inherited a couple systems where

ferm is absolutely fantastic, but in my experience, it doesn't always cope well with some more obscure iptables features; I've inherited a couple systems where retrofitting ferm was not possible, because it literally barfed when parsing the legacy ruleset. If you can use it, you should use it though. Also, I do need to play with nftables.