Imo this is nowhere near a pleasant way to do things for users. It would have been much better to just provide a separate iptables nft package by default during the install, as they really haven't given iptables the axe yet.