Bug#964014:

[Fabio Pedretti]

Given the many bugs of the default -nft alternative, maybe the best option
for buster would be to revert to using the -legacy version.