does netfilter-persistent reload open up the gates for half a moment?
- Netfilter-persistent scripts use
iptables-restoretool, that makes atomic reloading of an iptables rule set. - Netfilter-persistent scripts during a boot are run before interfaces will be bringing up (you can check output of
systemctl cat netfilter-persistent.service).