I think you're overthinking it. Nftables may look more complicated at first, but once you start using it, you'll find it's much easier to maintain firewall rule

I think you're overthinking it. Nftables may look more complicated at first, but once you start using it, you'll find it's much easier to maintain firewall rulesets with nftables than iptables. If you want to learn it, go through the exercise of building out a ruleset by hand. Take the iptables ruleset of some server with which you're familiar (or use the Arch wiki's example iptables firewall [1] if you don't have a good example at hand), and convert it line-by-line to nftables. Look up in the nftables docs for an equivalent of each iptables line (you're looking in all the right places for documentation -- nftables own wiki has lots of good information, as does the Arch and Gentoo wikis). When you install nftables, many distros will include a small starter config file at `/etc/nftables.conf` or /etc/sysconfig/nftables.conf`. Add rules to that file, and run `sudo nft -f /etc/nftables.conf` (or `sudo nft -f /etc/sysconfig/nftables.conf`) after each change to replace your old ruleset with your updated version. The `nft` command will check your syntax before applying the new ruleset, and if there's an error, it will instead abort and show you an error message that points to the problem line. Then use `sudo nft list ruleset` to view your current ruleset -- you'll notice some cases where nftables has re-written your rules to use the canonical form of the rule (or substituted a constant for a standard value etc). You can use the `iptables-translate` tool if you get stuck, but it won't really help you learn anything -- just as running some tool that generates a bunch of Rust code won't help you learn Rust. If you want to learn Rust, you have to write Rust code -- and if you want to learn nftables, you have to write nftables rulesets. [1] https://wiki.archlinux.org/title/Simple_stateful_firewall https://wiki.archlinux.org/title/Simple_stateful_firewall