Default banning action (e.g. iptables, iptables-new, iptables-multiport, shorewall, etc) for “allports” jails. It is used to define action_* variables. Can be overridden globally or per section within jail.local file

if config.networking.nftables.enable then "nftables-allports" else "iptables-allports"