IMO Linux is significantly better than the *BSDs at this particular use case.
Check out https://blog.cloudflare.com/l4drop-xdp-ebpf-based-ddos-mitig...
and:
Check out https://blog.cloudflare.com/l4drop-xdp-ebpf-based-ddos-mitig...
and:
If you did manage to figure out the iptables commands you now have to change them over to nftables. :)
Seriously though it's something I need to get familiar with, I do still have plenty of Linux boxes that face the public Internet and are currently dependent on iptables/ip6tables rulesets. The problem is I'm currently masking that pain with Ansible.
Typical hardware switches and routers just have one (sometimes expanded by includes/macros but still) config syntax to control every part of networking stack.
So you can configure interface and set its vlans all in one place instead of creating a dozen of ethX.Y devices then crerating a bunch of brY bridges and then attaching the interfaces to them
In linux instead you'd be using iproute2 set of tools to configure interfaces and static routing, iptables for IP ACLs, ebtables for ethernet ACLs (or now nftables I guess), without any tool to apply/revert changes at once
Many tried doing that but IMO haven't seen anything good.
Many also try to "simplify" iptables and all it ends up is me being annoyed coz I know which iptables commands I need to run but I need to translate it back into "higher" level config syntax. One exception being ferm ( http://ferm.foo-projects.org/ ), because it keeps iptables-like keywords just expands on that, but it is iptables only and kinda superseded by nftables syntax anyway.