Forward/NAT nftables rules

Hi, I'm trying to add a rule on NAT'ed traffic to reject certain local IPs from being masqueraded, but I can't see how it can be done with nftables backend. The problem: (1) --add-rule seems to always operate on iptables-restore, regardless of what backend is being used. (2) --add-rich-rule doesn't seem to provide a way to add rule on forwarded traffic. (3) there is seem to be no option like --add-rule, but for nftables specifically. Currently I had to switch to iptables backend to do: firewall-cmd --permanent --new-ipset=nonetvm --type=hash:ip firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.52 firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.53 firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.54 firewall-cmd --permanent --ipset=nonetvm --add-entry=192.168.1.55 # enp0s31f6 is the WAN interface in external zone firewall-cmd --permanent --direct --add-rule \ ipv4 filter FORWARD 0 -m set --match-set nonetvm src \ -o enp0s31f6 -j REJECT firewall-cmd --reload Please correct me if I'm wrong somewhere or is there simply no way to do this with firewalld using (now default) nftables backend?