It adds rules to in-kernel netfilter tables. On Linux at least, there is really no such thing as a firewall app, there are just different ways to add and manage

It adds rules to in-kernel netfilter tables. On Linux at least, there is really no such thing as a firewall app, there are just different ways to add and manage rules. The only 'approved' default app is nft (nftables), but any app can act on the in-kernel tables.