It's been a few years since I last fiddled with iptables. Now there's a new kid on the block:

nftables

Should I switch? Will I regret trying? I'm only doing basic stuff like NAT and port forwarding.

@kalle
Yes, you should switch.
It's not exactly 'new' either and is already the default in #Debian Stable.
@FreePietje ok, I know it's been around for several years, but I just wasn't aware of it until today. Thanks for input.
@FreePietje I'm on debian 9 currently, so not default on my machine.
@kalle That is far from ideal.
Not only is the version of the nftables package in oldstable old, a kernel >= 4.10 is recommended as well (https://packages.debian.org/stretch/nftables).
I'd recommend either upgrading your machine or 'play' with it in a VM which does run at least Stable.
Debian -- Details of package nftables in stretch

@FreePietje Thanks a lot for the info. I'm thinking of upgrading to stable anyway, so that's not a big deal.