Debian 10 and the iptables backend that changed underneath you

Buster defaults to the nftables backend with an iptables compatibility shim, so iptables -L and nft list ruleset can show different things and both are telling the truth.

$ update-alternatives --display iptables
iptables - auto mode
  link currently points to /usr/sbin/iptables-nft

# Docker and fail2ban both write iptables rules. under the shim
# they land in nftables tables that a legacy iptables-save misses.

$ update-alternatives --set iptables /usr/sbin/iptables-legacy
# which is what several tools' documentation still assumes

The practical failures are a firewall backup taken with iptables-save that restores nothing, and a monitoring check that reads rules and finds none. Neither is loud. Picking one backend deliberately and documenting it is worth ten minutes, because the mixed state is where the confusion lives. Docker in particular writes its rules through whichever the alternative points at, and switching after containers are running leaves orphaned rules behind.