diff --git a/.etckeeper b/.etckeeper
index 3e7a62b4..abe69a06 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -189,6 +189,7 @@ maybe chmod 0644 'default/fake-hwclock'
 maybe chmod 0644 'default/hwclock'
 maybe chmod 0644 'default/keyboard'
 maybe chmod 0644 'default/locale'
+maybe chmod 0644 'default/netfilter-persistent'
 maybe chmod 0644 'default/networking'
 maybe chmod 0644 'default/nfs-common'
 maybe chmod 0644 'default/nss'
@@ -345,6 +346,7 @@ maybe chmod 0755 'init.d/fake-hwclock'
 maybe chmod 0755 'init.d/hwclock.sh'
 maybe chmod 0755 'init.d/keyboard-setup.sh'
 maybe chmod 0755 'init.d/kmod'
+maybe chmod 0755 'init.d/netfilter-persistent'
 maybe chmod 0755 'init.d/networking'
 maybe chmod 0755 'init.d/nfs-common'
 maybe chmod 0755 'init.d/paxctld'
@@ -394,6 +396,8 @@ maybe chmod 0644 'iproute2/rt_scopes'
 maybe chmod 0644 'iproute2/rt_tables'
 maybe chmod 0755 'iproute2/rt_tables.d'
 maybe chmod 0644 'iproute2/rt_tables.d/README'
+maybe chmod 0755 'iptables'
+maybe chmod 0644 'iptables/rules.v4'
 maybe chmod 0644 'issue'
 maybe chmod 0644 'issue.net'
 maybe chmod 0755 'kernel'
@@ -419,6 +423,8 @@ maybe chmod 0644 'locale.gen'
 maybe chmod 0755 'logcheck'
 maybe chmod 0755 'logcheck/ignore.d.server'
 maybe chmod 0644 'logcheck/ignore.d.server/gpg-agent'
+maybe chmod 0755 'logcheck/ignore.d.server/netfilter-persistent'
+maybe chmod 0644 'logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent'
 maybe chmod 0644 'logcheck/ignore.d.server/rng-tools-debian'
 maybe chmod 0644 'logcheck/ignore.d.server/rsyslog'
 maybe chmod 0755 'logcheck/violations.ignore.d'
@@ -626,6 +632,8 @@ maybe chmod 0755 'systemd/system/getty@tty1.service.d'
 maybe chmod 0644 'systemd/system/getty@tty1.service.d/noclear.conf'
 maybe chmod 0755 'systemd/system/halt.target.wants'
 maybe chmod 0755 'systemd/system/multi-user.target.wants'
+maybe chmod 0755 'systemd/system/netfilter-persistent.service.d'
+maybe chmod 0644 'systemd/system/netfilter-persistent.service.d/iptables.conf'
 maybe chmod 0755 'systemd/system/network-online.target.wants'
 maybe chmod 0755 'systemd/system/poweroff.target.wants'
 maybe chmod 0755 'systemd/system/rc-local.service.d'
diff --git a/alternatives/ip6tables.service b/alternatives/ip6tables.service
new file mode 120000
index 00000000..8589be0d
--- /dev/null
+++ b/alternatives/ip6tables.service
@@ -0,0 +1 @@
+/lib/systemd/system/netfilter-persistent.service
\ No newline at end of file
diff --git a/alternatives/iptables.service b/alternatives/iptables.service
new file mode 120000
index 00000000..8589be0d
--- /dev/null
+++ b/alternatives/iptables.service
@@ -0,0 +1 @@
+/lib/systemd/system/netfilter-persistent.service
\ No newline at end of file
diff --git a/default/netfilter-persistent b/default/netfilter-persistent
new file mode 100644
index 00000000..661c678e
--- /dev/null
+++ b/default/netfilter-persistent
@@ -0,0 +1,10 @@
+# Configuration for netfilter-persistent
+# Plugins may extend this file or have their own
+
+FLUSH_ON_STOP=0
+
+# Set to yes to skip saving rules/sets when netfilter-persistent is called with
+# the save parameter
+# IPTABLES_SKIP_SAVE=yes
+# IP6TABLES_SKIP_SAVE=yes
+# IPSET_SKIP_SAVE=yes
diff --git a/init.d/netfilter-persistent b/init.d/netfilter-persistent
new file mode 100755
index 00000000..1b4f1c0a
--- /dev/null
+++ b/init.d/netfilter-persistent
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+# This file is part of netfilter-persistent
+# Copyright (C) 2014 Jonathan Wiltshire
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation, either version 3
+# of the License, or (at your option) any later version.
+
+### BEGIN INIT INFO
+# Provides:          netfilter-persistent
+# Required-Start:    mountkernfs $remote_fs
+# Required-Stop:     $remote_fs
+# Default-Start:     S
+# Default-Stop:      0 1 6
+# Short-Description: Load boot-time netfilter configuration
+# Description:       Loads boot-time netfilter configuration
+### END INIT INFO
+
+. /lib/lsb/init-functions
+
+case "$1" in
+start|restart|reload|force-reload)
+    log_action_begin_msg "Loading netfilter rules"
+    /usr/sbin/netfilter-persistent start
+    log_action_end_msg $?
+	;;
+save)
+    log_action_begin_msg "Saving netfilter rules"
+    /usr/sbin/netfilter-persistent save
+    log_action_end_msg $?
+	;;
+stop)
+    log_action_begin_msg "Stopping netfilter rules"
+    /usr/sbin/netfilter-persistent stop
+    log_action_end_msg $?
+	;;
+flush)
+    log_action_begin_msg "Flushing netfilter rules"
+    /usr/sbin/netfilter-persistent flush
+    log_action_end_msg $?
+	;;
+*)
+    echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
+    exit 1
+    ;;
+esac
+
+exit $rc
diff --git a/iptables/rules.v4 b/iptables/rules.v4
new file mode 100644
index 00000000..9bb5c35e
--- /dev/null
+++ b/iptables/rules.v4
@@ -0,0 +1,75 @@
+# Generated by iptables-save v1.8.7 on Wed Dec  1 11:37:42 2021
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER - [0:0]
+:DOCKER-INGRESS - [0:0]
+:DOCKER-ISOLATION-STAGE-1 - [0:0]
+:DOCKER-ISOLATION-STAGE-2 - [0:0]
+:DOCKER-USER - [0:0]
+-A FORWARD -j DOCKER-USER
+-A FORWARD -j DOCKER-INGRESS
+-A FORWARD -j DOCKER-ISOLATION-STAGE-1
+-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -o docker0 -j DOCKER
+-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
+-A FORWARD -i docker0 -o docker0 -j ACCEPT
+-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -o docker_gwbridge -j DOCKER
+-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
+-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
+-A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 3001 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8090 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8086 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8086 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8083 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8083 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 2342 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 2342 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 9443 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 9443 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 9000 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 9000 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8000 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8000 -j ACCEPT
+-A DOCKER-INGRESS -j RETURN
+-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
+-A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2
+-A DOCKER-ISOLATION-STAGE-1 -j RETURN
+-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
+-A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP
+-A DOCKER-ISOLATION-STAGE-2 -j RETURN
+-A DOCKER-USER -j RETURN
+COMMIT
+# Completed on Wed Dec  1 11:37:42 2021
+# Generated by iptables-save v1.8.7 on Wed Dec  1 11:37:42 2021
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+:DOCKER - [0:0]
+:DOCKER-INGRESS - [0:0]
+-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
+-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
+-A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
+-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
+-A POSTROUTING -o docker_gwbridge -m addrtype --src-type LOCAL -j MASQUERADE
+-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
+-A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE
+-A DOCKER -i docker0 -j RETURN
+-A DOCKER -i docker_gwbridge -j RETURN
+-A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j DNAT --to-destination 172.18.0.2:3001
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j DNAT --to-destination 172.18.0.2:8090
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8086 -j DNAT --to-destination 172.18.0.2:8086
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8083 -j DNAT --to-destination 172.18.0.2:8083
+-A DOCKER-INGRESS -p tcp -m tcp --dport 2342 -j DNAT --to-destination 172.18.0.2:2342
+-A DOCKER-INGRESS -p tcp -m tcp --dport 9443 -j DNAT --to-destination 172.18.0.2:9443
+-A DOCKER-INGRESS -p tcp -m tcp --dport 9000 -j DNAT --to-destination 172.18.0.2:9000
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.18.0.2:8000
+-A DOCKER-INGRESS -j RETURN
+COMMIT
+# Completed on Wed Dec  1 11:37:42 2021
diff --git a/logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent b/logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent
new file mode 100644
index 00000000..06e1ca13
--- /dev/null
+++ b/logcheck/ignore.d.server/netfilter-persistent/netfilter-persistent
@@ -0,0 +1 @@
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd\[1\]: netfilter-persistent\.service: Dependency Conflict(s|edBy)=(ip(6)?tables|ipset)\.service dropped, merged into netfilter-persistent\.service$
diff --git a/rc0.d/K01netfilter-persistent b/rc0.d/K01netfilter-persistent
new file mode 120000
index 00000000..07299006
--- /dev/null
+++ b/rc0.d/K01netfilter-persistent
@@ -0,0 +1 @@
+../init.d/netfilter-persistent
\ No newline at end of file
diff --git a/rc1.d/K01netfilter-persistent b/rc1.d/K01netfilter-persistent
new file mode 120000
index 00000000..07299006
--- /dev/null
+++ b/rc1.d/K01netfilter-persistent
@@ -0,0 +1 @@
+../init.d/netfilter-persistent
\ No newline at end of file
diff --git a/rc6.d/K01netfilter-persistent b/rc6.d/K01netfilter-persistent
new file mode 120000
index 00000000..07299006
--- /dev/null
+++ b/rc6.d/K01netfilter-persistent
@@ -0,0 +1 @@
+../init.d/netfilter-persistent
\ No newline at end of file
diff --git a/rcS.d/S01netfilter-persistent b/rcS.d/S01netfilter-persistent
new file mode 120000
index 00000000..07299006
--- /dev/null
+++ b/rcS.d/S01netfilter-persistent
@@ -0,0 +1 @@
+../init.d/netfilter-persistent
\ No newline at end of file
diff --git a/systemd/system/multi-user.target.wants/netfilter-persistent.service b/systemd/system/multi-user.target.wants/netfilter-persistent.service
new file mode 120000
index 00000000..8589be0d
--- /dev/null
+++ b/systemd/system/multi-user.target.wants/netfilter-persistent.service
@@ -0,0 +1 @@
+/lib/systemd/system/netfilter-persistent.service
\ No newline at end of file
diff --git a/systemd/system/netfilter-persistent.service.d/iptables.conf b/systemd/system/netfilter-persistent.service.d/iptables.conf
new file mode 100644
index 00000000..2d388238
--- /dev/null
+++ b/systemd/system/netfilter-persistent.service.d/iptables.conf
@@ -0,0 +1,2 @@
+[Unit]
+Conflicts=iptables.service ip6tables.service