well nftables is the future and IMO the better choice for ease of control too. It’s been the official successor since 2014 and every major distro defaults to it now, or uses iptables-nft as a compatibility shim. Even firewalld and UFW use it as their backend. So it’s arguably better time spent to focus on nftables.
Way back, I was really hoping to use UFW … after first looking at IPTABLES itself to see if I wanted to work with that “beast”.
Unfortunately, UFW did not give me the degree of control that I wanted (it’s been so long since I dug into that, so please don’t ask for details). So, I had to walk away from that and put my efforts into a customized IPTABLES-based firewall.
BTW, I will never understand the move replace the parameter flags (easier to parse out) vs the “indistinguishable” keywords mixed in with the values. That is a move that, to me, is driven by automation of machine recognition, vs ease of recognition and comprehension by Humans. IMHO, Bad Bad Move!!!
the ufw application is capable of doing anything that iptables can do. This is achieved by using several sets of rules files, which are nothing more than iptables-restore compatible text files. Fine-tuning ufw and/or adding additional iptables commands not offered via the ufw command is a matter of editing various text files
Their claims is why I really wanted it to work for me … but it didn’t!
I got tired of pulling my hair to understand the sequencing/prioritization of the various setup files for UFW. Hence, the IPTABLES approach which I took.