Rate-limit new connections

Throttle SSH brute-force; over-limit packets fall through to the chain policy

nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept

More nftables commands

Watch ruleset changes live

nft monitor ruleset

Streams add/delete events as they happen; great for debugging dynamic rules
Atomic backup and restore of ruleset

nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf

nft -f applies the whole file atomically; partial failure rolls back, no half state
Hardware flowtable offload

nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft

Offloads established flows to fast path; add 'flags offload' for NIC hardware offload
Create input chain with drop policy

nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'

Base-chain default-deny; note: add accept rules first or you lock yourself out
Named set as IP blocklist

nft add set inet filter blocklist '{ type ipv4_addr ; flags interval ; }' && nft add element inet filter blocklist '{ 10.0.0.0/8, 192.0.2.5 }'

Reusable named set; flags interval lets you store CIDR ranges, not just hosts