Is it possible to switch from the legacy FireWall to the mainstream nftables?

[syangcniao]

Is it possible to switch from the legacy FireWall to the mainstream nftables?
Once I started using nftables as my system firewall, I could never go back.
Its syntax is concise, clean, and easy to understand.
The old FireWall is far more cumbersome to operate.

[urb59]

It is not possible directly, but with a trick.

You have to use the CMD_CYCLE_* variables. This is what I put at the end of /etc/fwknop/access.conf:

CMD_CYCLE_OPEN /usr/sbin/nft add element inet filter fwknop-input { $SRC . $PORT timeout 30s }
CMD_CYCLE_CLOSE NONE
CMD_CYCLE_TIMER 30

And my nftables begins with:
table inet filter { set fwknop-input { type ipv4_addr . inet_service ; size 10 ; flags timeout ; } ...

[syangcniao]

I implemented this in much the same way.Even if you intend to keep both firewalls running concurrently, there are inherent risks of conflicts, along with chaotic management and muddled rule inspection — this is particularly prominent when checking the currently active ruleset.
The output of nft list ruleset gets flooded with irrelevant rules from firewalld that you have no interest in.

[zltnmanya]

I started working on a possible implementation a while ago:
https://github.com/zltnmanya/fwknop/tree/tp_nftables

I'm open to any input on what are the possible pitfalls or compatility issues, that I'd have to mind.