libvirt works well enough that virtual machines do networking just fine without nftables (everything works without a firewall, shocking right?), however trying to start nftables after libvirt adds its rules results in a whole load of this:
$ sudo rc-service nftables start
* Loading nftables state and starting firewall ...
/var/lib/nftables/rules-save:59:46-63: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
iifname "virbr0" counter packets 0 bytes 0 xt target "REJECT"
^^^^^^^^^^^^^^^^^^
/var/lib/nftables/rules-save:70:46-65: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
oifname "virbr0" ip daddr 192.168.122.0/24 xt match "conntrack" counter packets 0 bytes 0 accept
^^^^^^^^^^^^^^^^^^^^
/var/lib/nftables/rules-save:71:46-63: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
oifname "virbr0" counter packets 0 bytes 0 xt target "REJECT"
^^^^^^^^^^^^^^^^^^
/var/lib/nftables/rules-save:82:99-120: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
meta l4proto 6 ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 xt target "MASQUERADE"
^^^^^^^^^^^^^^^^^^^^^^
/var/lib/nftables/rules-save:83:100-121: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
meta l4proto 17 ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 xt target "MASQUERADE"
^^^^^^^^^^^^^^^^^^^^^^
/var/lib/nftables/rules-save:84:84-105: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 xt target "MASQUERADE"
^^^^^^^^^^^^^^^^^^^^^^
/var/lib/nftables/rules-save:94:59-78: Error: unsupported xtables compat expression, use iptables-nft with this ruleset
oifname "virbr0" udp dport 68 counter packets 0 bytes 0 xt target "CHECKSUM"
^^^^^^^^^^^^^^^^^^^^ [ !! ]
* ERROR: nftables failed to start
Admittedly, I set up libvirt first and then migrated to nftables by using the iptables-nft and nftables-openrc packages, but I doubt that caused any actual issues.
So, how do I force libvirt to "use iptables-nft", or otherwise make both work on the same system?