Three biases decide most calls:

Evaluation order belongs to the engine, not the file. nftables runs every base chain on a hook by priority and only drop is final; Caddy sorts directives by a built-in table; nginx discards inherited proxy_set_header the moment one is set lower; Traefik ranks routers by rule length; Authelia and cloudflared take the first match. Read the engine's order before trusting the file's.
Who is trusted is a list, and every tool ships a different one. Caddy trusts no proxy for X-Forwarded-*, HAProxy and Cloudflare append the client's, Unbound refuses every client but localhost, AdGuard Home on 0.0.0.0 answers the internet, Avahi reflects to every interface, Tailscale on Linux accepts no routes, NetBird pushes them unapproved. Name the list in the config; never assume its direction.
Every filter has a second path around it. IPv6 beside an ip rule in an inet table; a published container port beside the host input chain; a flowtable beside the later hooks; a reachable origin beside Cloudflare Access; an established connection beside a CrowdSec ban; a default-bridge container beside the LAN resolver. Close the second path or state that it is open.

networking

Filtering