Chapter 4 – The Linux Firewall

1. Hopefully, you would consider using nftables. While iptables will still be supported for several years, nftables is more efficient (CPU-wise), and supports IPv6. It's also more flexible in "matching" traffic, allowing easier matches on individual fields in packets for further processing.
2. An easy method to support central firewall standards (without adding orchestration or configuration management tools into the mix) would be to use nft include files. These files can be managed in a single location, given meaningful names, then copied out to target servers that match the use case for each of these include files. For instance, having an include file for web servers, DNS hosts, or DHCP servers is commonly seen. Having a separate include file to allow host administration only from a small set of administrative "jump hosts," address ranges, or subnets is another very common use case.

   Even without include files, though...