My preferred method of working with nftables is to just start with a template and hand-edit it to my liking, as we did in the previous section. But for those who'd rather do everything from the command line, there's the nft utility.
Even if you know that you'll always create firewalls by hand-editing nftables.conf, there are still a couple of practical reasons to know about the nft utility.
Let's say that you've observed an attack in progress, and you need to stop it quickly without bringing down the system. With an nft command, you can create a custom rule on the fly that will block the attack. Creating nftables rules on the fly also allows you to test the firewall as you configure it, before making any permanent changes. ...
