In reply to @schnecfk:ruhr-uni-bochum.de
Just for clarification: it looks like nftables is intended to replace iptables/arptables and more in the long run, correct? If that's the case, it's probably a good idea to start using it and to get used to it

In reply to @andi:kack.it
iptables is already using it under the hood.

  verifiedNetfilter = { text, modules ? [ ] }:
    let
      file = pkgs.writeText "netfilter" text;
      vmTools = pkgs.vmTools.override {
        rootModules =
          [
            "virtio_pci"
            "virtio_mmio"
            "virtio_blk"
            "virtio_balloon"
            "virtio_rng"
            "ext4"
            "unix"
            "9p"
            "9pnet_virtio"
            "crc32c_generic"
          ] ++ modules;
      };

      check = vmTools.runInLinuxVM (
        pkgs.runCommand "nft-check"
          {
            buildInputs = [ pkgs.nftables ];
            inherit file;
          } ''
          set -ex
          # make sure protocols & services are known
          ln -s ${pkgs.iana-etc}/etc/protocol /etc/protocol
          ln -s ${pkgs.iana-etc}/etc/services /etc/services
          # test the configuration
          nft --file $file
          set +x
        ''
      );
    in
    "#checked with ${check}\n" + text;

this beauty