iptables is totally screwed up, but have you tried nftables?
I've converted all my Linux servers to nftables specifically due to its syntax similarity to BSD
Follow
The main one: rather than series of rather ugly command-line `iptables -A` calls, `nftables` is a quite elegant language.
this has a little to do with pf, honestly. I am a happy user of pf , and being honest I can't see how nftables is similar...