The linux router currently programs the linux network stack with ip and iptables. iptables is unavoidable because the corresponding netlink APIs are not safe for direct use. However, everything we do with ip we could just do directly over a netlink socket.

This would in particular help embedded systems that ship with the Busybox version of ip, which is stripped down and doesn't understand advanced commands like policy routing rules, which Tailscale requires.