Nftables: a new packet filtering engine

Translating normal header matches like address and port matches should work fine, there really arent't any subtleties in that area. It might look differently in case of matches with more complex behaviour, like, lets say, the policy match. But with the necessary care I wouldn't expect many problems.

That said, iptables is certainly going to stay for quite a while. The rough plan so far is to add a converter/parser for the old syntax, shake out the bugs, and at some point transparently enable it in userspace once it has proven itself. A couple of years sounds realistic to me. But since this hasn't been discussed yet, things might also turn out differently.