Curious, what specifically does nftables offer in this context that iptables doesn't ?