Though not yet installed by default, you may want to look into the nft and nftables systems.
nftables is a replacement for the existing kernel framework, and nft is the accompanying command-line tool.
