From Debian BTS: https://bugs.debian.org/913088

There seems to be some issues with the '-f' option in iptables-nft.
Apparently is not only in the printing code path but probably also in expr generation code. See original bug report in debian for more tests and details.


==== 8< ====
Note the output of iptables-translate:

    iptables-translate -A INPUT -f -j DROP
    nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 counter drop

However, if I execute this command:

    iptables -A INPUT -f -j DROP

The following is added (output of 'nft list table filter'):

    table ip filter {
        chain INPUT {
            ...
            ip frag-off & 65311 != 0 counter packets 0 bytes 0 drop
        }
        ...
    }

Note: 65311 (dec) = 0xff1f and not 0x1ffff. Could it be that the byte 
order for the mask is somehow swapped?
==== 8< ====