Migrating a small firewall from iptables to nftables

Draft notes. Will be cleaned up later.

Work in progress. The short version: measure first, change one thing at a time, and keep the old config around.