Thanks for the info. Some day I'll try the shiny modern domain specific distros and learn the little peculiarities. I use a weird mix of Debian, NixOS and LMDE and it's relatively straightforward to add firewall rules to those, both dynamically to nftables and to the config... And I believe Debian doesn't even come with firewalling out of the box...