firewall: switch to nftables

Issue #61 new