We migrated to a linux nftables based firewall.

I never liked iptables, but nftables is pretty nice to write and use.

And with one "flowtable" line added to your nftables.conf you can even in theory have faster routing when conntrack is active

https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1...