no idea, iproute basically just works. Though i do run this:

{
  lib,
  ...
}:

{
  nixpkgs.overlays = [
    (final: prev: {
      networkmanager = prev.networkmanager.overrideAttrs (old: {
        mesonFlags = lib.filter (f: !(lib.hasPrefix "-Diptables=" f)) old.mesonFlags or [ ];
      });
      iproute2 = prev.iproute2.override {
        iptables = null;
      };
      nftables = prev.nftables.override { withXtables = false; };
    })
  ];
  networking.nftables.enable = true;
  system.forbiddenDependenciesRegexes = [ "iptables" ];
}

No need for iptables if one can have nftables, might as well remove it from iproute. Maybe i got lucky and removed the bad code with that? Who knows