NFTABLES IS ,L9UX'S CURR5T PACKET-FILT]+
FRAME"W  M]G$ 9 K]NEL #C4AC "<,JANU>Y
#BJAD"> "U NETFILT]'S ,PATRICK ,MC,H>DY1
REPLAC+ ! IPTABLES FAMILY
"<IP_/IP#F_/>P_/EB"> ) "O SUBSY/EM & "O
US]SPACE TOOL1 NFT4 ,": IPTABLES H>DCOD$
F\R SEP>ATE TABLE *A9S P] PROTOCOL1
NFTABLES IS A SMALL REGI/]-MA*9E3 RULES
COMPILE TO BYTECODE ! K]NEL EXECUTES 
JUMPS1 COMP>ISONS1 SET LOOKUPS1 V]DICTS 
S A DECADE ( BOLT-ON IPTABLES EXT5.NS
2CAME EXPRES.NS 9 A R1L GRAMM>4
,:AT X BUYS Y
,! PRACTICAL W9S3 "ND SETS & MAPS "<IP
SADDR _< #AJ4J4J4A1 #AJ4J4J4G _> 9L9E1
OR MUTABLE SETS Y ADD TO )\T REWRIT+
RULES">1 VMAPS "<LOOKUP  V]DICT">1 ! 9ET
FAMILY "<,I,PV#D "6 ,I,PV#F 9 "O TABLE 
! R1SON NFT KILLS ! DUAL-RULEBOOK
PROBLEM">1 ATOMIC RULESET REPLACE;T
"<NFT -;F SWAPS ! _W 9 "O TRANSAC;N">1 &
IPTABLES-TRANSLATE = MIGRAT+ OLD RULES4
,! NETDEV FAMILY EV5 FILT]S AT 9GRESS 2F
PACKETS R1* ! /ACK4
,R1D+ X
NFT LI/ RULESET PR9TS ! :OLE FIREWALL Z
A SCRIPT  TABLES [N *A9S [N RULES1 TYPE
FILT] HOOK 9PUT PRIOR;Y FILT]2 POLICY
DROP2 DECL>ES ! *A9'S PLACE 9 ! PIPEL9E1
& C.T]S SIT 9L9E4 ,! MIGRA;N /ORY IS
G5TLE BY DESIGN3 IPTABLES COMM&S / "W "?
COMPAT TRANSLA;N ON MO/ 4TROS1 B ANY?+
NEW IS WRITT5 9 NFT  *APT] #AH'S
FIREWALL SEC;N & ! SECUR;Y *APT]'S H>D5+
*ECKLI/ BO? SP1K X NATIVELY4
,SEE AL
- ,NET"W+  ": NFT F/ APPE>S 9 ! H&BOOK -
,L9UX ,SECUR;Y  ! H>D5+ *ECKLI/ USES X -
,9SIDE A ,L9UX ,SY/EM  NETFILT]'S PLACE
9 ! K]NEL - ,L9UX  ,WIRE,GU>D  ,S,E,L9UX