nftables
Also called: nft, netfilter, iptables replacement
nftables is the Linux kernel's packet filtering framework, the successor to iptables, used to express firewall rules including default-deny egress policies.
nftables is the packet classification framework in the Linux kernel that replaced iptables, ip6tables, arptables and ebtables with one system and one syntax.
Practical advantages over iptables: a single rule can match both IPv4 and IPv6, sets and maps make large allowlists efficient, and rule updates are atomic — you cannot leave the firewall half-configured mid-change.
For an appliance it is where an air-gapped posture is actually enforced. A default-deny egress policy with a small allowlist (typically RFC1918 and mDNS) means a compromised process cannot exfiltrate data even if it wants to.
Most distributions still ship an iptables command, but it is usually a translation layer
over nftables underneath.