Default banning action (e.g. iptables, iptables-new, iptables-multiport, iptables-ipset-proto6-allports, shorewall, etc). It is used to define action_* variables. Can be overridden globally or per section within jail.local file

if config.networking.nftables.enable then "nftables-multiport" else "iptables-multiport"