nftables

Fix iptables -C 'Bad rule (does a matching rule exist?)' error for NAT PREROUTING REDIRECT rules visible in -t nat -L. Learn table mismatch, --to-ports syntax, hostname resolution, nftables issues, and exact verification with -S and iptables-save.

Master iptables rules for WireGuard wg0: drop all incoming packets except UDP port 51821. Why ACCEPT+DROP beats single negated rule. Avoid pitfalls like negation logic, rule ordering, connection tracking, INPUT vs FORWARD chains.