Currently when building nftables without xtables support, then any nft_compat expression is silently skipped. This adds minimal support so we will at least be able to print out that an xtables match is in use in a rule. Example: oifname "eth0" # xt_policy counter packets 0 bytes 0 accept for a rule added via iptables-nft -A OUTPUT -m policy ...