nftables and iptables with and without bitmasks