Just looking toward the future. I think bpf is cool but not aimed at production routing that most network techs can approach. nftables fixes so many issues of iptables and is generally viewed as it's replacement. nftables also has a smaller attack surface due to its youth mostly.

So I made the choice to go ahead and focus on learning nft. It's been enjoyable.

Is that true? I thought nftables was still behind on supported features compared to iptables and nftables runs on a VM.

Anyway, nftables should be nicer to administer. More pf-like.