IPv6: Virtual router nftables rules aren't restored after manual reboot (IPv6 firewall and ACLs missing) #14619

problem

At boot, postinit.sh runs nft -f /etc/iptables/rules.nftables. That file is saved with nft list ruleset, so on routers other than routed mode it also contains the iptables-nft tables, which nft can't parse. The whole restore fails:

/etc/iptables/rules.nftables:74:42-59: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
		udp dport 68 counter packets 0 bytes 0 xt target CHECKSUM

IPv4 rules come back from rules.v4. The IPv6 firewall and ACLs only exist in nftables and rules.v6 is empty, so guest IPv6 is unfiltered until CloudStack sends the router its config again.
A start or reboot from CloudStack does that straight away. After a reboot from the router's shell, the rules stay missing until something makes CloudStack resend them, such as a firewall or ACL rule change or a network restart.

Routed-mode routers aren't affected. They have no iptables tables, so their saved file restores fine.

This is an edge case, as routers are normally rebooted from CloudStack. A router should still come back up without errors after a reboot from its own shell.

versions

CloudStack 4.22.1.1, system VM template with nftables 1.0.6 (Debian 12), KVM on AlmaLinux 9.8.

The steps to reproduce the bug

1. On any isolated network's virtual router, run nft -c -f /etc/iptables/rules.nftables. It fails with the error above.
2. On an isolated network with IPv6, add an IPv6 firewall rule that allows inbound ICMP from one address only. Pings from any other address are blocked.
3. Reboot the router from its console (reboot).
4. After boot, nft list tables has no ip6 ip6_firewall table, and pings from any address reach the guest.

What to do about it?

Today rules.nftables holds the whole ruleset, iptables tables included, and those break the restore. Saving every table except the iptables ones (filter, nat, mangle, raw, security) fixes it, as those are already saved in rules.v4.
I tested this in a lab with isolated, VPC, routed and plain routers. The IPv6 firewall and ACLs came back after a simulated boot, and IPv4 rules were unchanged.