#!/bin/sh
set -eu

# See ferm-systemd-reboot-alt-xt: nftables must be disabled so that early
# boot doesn't bring up nft-backed rules regardless of the pinned
# alternative, which would otherwise make the legacy checks below meaningless.
systemctl disable --now nftables

update-alternatives --set iptables /usr/sbin/iptables-legacy
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
exec "$(dirname "$0")/ferm-systemd-cache-reboot"
