But definitively, KVM is quite a bit far more hassle-free for everything than an OpenVZ pr any container system for any VPS.netfilter iptables (quickly to be replaced by nftables) is really a person-House command line utility to configure kernel packet filtering procedures made by netfilter.