19 hours ago
nftables
iptables is not the firewall on your Debian box anymore. The command still works, but it has been a compatibility shim over the nftables kernel subsystem for years. The quiet half of that migration is done. The loud half, writing native nft rules, is the one most people skipped, and it is where the actual wins live - atomic ruleset reloads that cannot lock you out halfway, and native sets and maps that collapse a thousand rules into one. Here is the model, the two features worth the switch, and the migration footguns nobody warns you about.