Linux kernels have had packet filtering since the 1.1 series. The
  first generation, based on ipfw from BSD, was ported by Alan Cox in
  late 1994. This was enhanced by Jos Vos and others for Linux 2.0; the
  userspace tool 'ipfwadm' controlled the kernel filtering rules. In
  mid-1998, for Linux 2.2, I reworked the kernel quite heavily, with the
  help of Michael Neuling, and introduced the userspace tool 'ipchains'.
  Finally, the fourth-generation tool, 'iptables', and another kernel
  rewrite occurred in mid-1999 for Linux 2.4.

моё развитие закончилось тоже на iptables (застал ipchains тоже)

люди, скажите, что учить, чтоб опять через 2-3 года не пришлось переучиваться?

или может синтаксис iptables как золотой стандарт останется?

Спасибо!

flush ruleset

table ip filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # accept any localhost traffic
        iif lo accept

        iif wg0 accept

        # accept ICMP traffic
        ip protocol icmp accept

        # accept traffic originated from us
        ct state established,related accept

        # accept SSH, HTTP
        iif eth0 tcp dport ssh accept
        iif eth0 tcp dport http accept
        iif eth0 tcp dport https accept

        # iperf3
        iif eth0 tcp dport 5201 accept
        iif eth0 udp dport 5201 accept

        # accept DNS
        iif eth0 tcp dport 53 accept
        iif eth0 udp dport 53 accept

        # accept mail
        iif eth0 tcp dport { 25, 587, 993 } accept
    }
    chain output {
        type filter hook output priority 0;
    }

    chain prerouting {
        type nat hook prerouting priority -100;

        # mail DNAT
        iif eth0 tcp dport { 25, 587, 993 } dnat to 10.100.0.249
    }
    chain postrouting {
         type nat hook postrouting priority 100;

         # VPN NAT
         oifname "eth0" masquerade random,persistent
    }
}