diff --git a/.etckeeper b/.etckeeper
index edc0632b..73592b39 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -569,6 +569,8 @@ maybe chmod 0644 'iproute2/rt_scopes'
 maybe chmod 0644 'iproute2/rt_tables'
 maybe chmod 0755 'iproute2/rt_tables.d'
 maybe chmod 0644 'iproute2/rt_tables.d/README'
+maybe chmod 0755 'iptables'
+maybe chmod 0644 'iptables/rules.v4'
 maybe chmod 0644 'issue'
 maybe chmod 0644 'issue.net'
 maybe chmod 0755 'java-11-openjdk'
@@ -815,6 +817,8 @@ maybe chmod 0644 'locale.gen'
 maybe chmod 0755 'logcheck'
 maybe chmod 0755 'logcheck/ignore.d.server'
 maybe chmod 0644 'logcheck/ignore.d.server/gpg-agent'
+maybe chmod 0755 'logcheck/ignore.d.server/netfilter-persistent'
+maybe chmod 0644 'logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent'
 maybe chmod 0644 'logcheck/ignore.d.server/rng-tools-debian'
 maybe chmod 0644 'logcheck/ignore.d.server/rsyslog'
 maybe chmod 0755 'logcheck/violations.ignore.d'
@@ -1299,6 +1303,8 @@ maybe chmod 0644 'systemd/system/getty@tty1.service.d/noclear.conf'
 maybe chmod 0644 'systemd/system/gitea.service'
 maybe chmod 0755 'systemd/system/halt.target.wants'
 maybe chmod 0755 'systemd/system/multi-user.target.wants'
+maybe chmod 0755 'systemd/system/netfilter-persistent.service.d'
+maybe chmod 0644 'systemd/system/netfilter-persistent.service.d/iptables.conf'
 maybe chmod 0755 'systemd/system/network-online.target.wants'
 maybe chmod 0755 'systemd/system/poweroff.target.wants'
 maybe chmod 0755 'systemd/system/rc-local.service.d'
diff --git a/alternatives/ip6tables.service b/alternatives/ip6tables.service
new file mode 120000
index 00000000..8589be0d
--- /dev/null
+++ b/alternatives/ip6tables.service
@@ -0,0 +1 @@
+/lib/systemd/system/netfilter-persistent.service
\ No newline at end of file
diff --git a/alternatives/iptables.service b/alternatives/iptables.service
new file mode 120000
index 00000000..8589be0d
--- /dev/null
+++ b/alternatives/iptables.service
@@ -0,0 +1 @@
+/lib/systemd/system/netfilter-persistent.service
\ No newline at end of file
diff --git a/default/netfilter-persistent b/default/netfilter-persistent
index 7b31799e..661c678e 100644
--- a/default/netfilter-persistent
+++ b/default/netfilter-persistent
@@ -2,3 +2,9 @@
 # Plugins may extend this file or have their own
 
 FLUSH_ON_STOP=0
+
+# Set to yes to skip saving rules/sets when netfilter-persistent is called with
+# the save parameter
+# IPTABLES_SKIP_SAVE=yes
+# IP6TABLES_SKIP_SAVE=yes
+# IPSET_SKIP_SAVE=yes
diff --git a/iptables/rules.v4 b/iptables/rules.v4
new file mode 100644
index 00000000..361a7378
--- /dev/null
+++ b/iptables/rules.v4
@@ -0,0 +1,51 @@
+# Generated by iptables-save v1.8.7 on Mon Jan 24 09:11:23 2022
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER - [0:0]
+:DOCKER-INGRESS - [0:0]
+:DOCKER-ISOLATION-STAGE-1 - [0:0]
+:DOCKER-ISOLATION-STAGE-2 - [0:0]
+:DOCKER-USER - [0:0]
+-A FORWARD -j DOCKER-USER
+-A FORWARD -j DOCKER-INGRESS
+-A FORWARD -j DOCKER-ISOLATION-STAGE-1
+-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -o docker0 -j DOCKER
+-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
+-A FORWARD -i docker0 -o docker0 -j ACCEPT
+-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -o docker_gwbridge -j DOCKER
+-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
+-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
+-A DOCKER-INGRESS -j RETURN
+-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
+-A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2
+-A DOCKER-ISOLATION-STAGE-1 -j RETURN
+-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
+-A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP
+-A DOCKER-ISOLATION-STAGE-2 -j RETURN
+-A DOCKER-USER -j RETURN
+COMMIT
+# Completed on Mon Jan 24 09:11:23 2022
+# Generated by iptables-save v1.8.7 on Mon Jan 24 09:11:23 2022
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+:DOCKER - [0:0]
+:DOCKER-INGRESS - [0:0]
+-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
+-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
+-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
+-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
+-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
+-A POSTROUTING -o docker_gwbridge -m addrtype --src-type LOCAL -j MASQUERADE
+-A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE
+-A DOCKER -i docker0 -j RETURN
+-A DOCKER -i docker_gwbridge -j RETURN
+-A DOCKER-INGRESS -j RETURN
+COMMIT
+# Completed on Mon Jan 24 09:11:23 2022
diff --git a/logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent b/logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent
new file mode 100644
index 00000000..06e1ca13
--- /dev/null
+++ b/logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent
@@ -0,0 +1 @@
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[1\]: netfilter-persistent\.service: Dependency Conflict(s|edBy)=(ip(6)?tables|ipset)\.service dropped, merged into netfilter-persistent\.service$
diff --git a/systemd/system/netfilter-persistent.service b/systemd/system/netfilter-persistent.service
deleted file mode 120000
index dc1dc0cd..00000000
--- a/systemd/system/netfilter-persistent.service
+++ /dev/null
@@ -1 +0,0 @@
-/dev/null
\ No newline at end of file
diff --git a/systemd/system/netfilter-persistent.service.d/iptables.conf b/systemd/system/netfilter-persistent.service.d/iptables.conf
new file mode 100644
index 00000000..2d388238
--- /dev/null
+++ b/systemd/system/netfilter-persistent.service.d/iptables.conf
@@ -0,0 +1,2 @@
+[Unit]
+Conflicts=iptables.service ip6tables.service