Nftables: a new packet filtering engine

you can match on every packet of the connection. most people don't bother, but all you have to do is to not put 'if established allow' at the top of your ruleset.

the question of what is done automaticaly and what should be done explicitly can be argued forever, I see this as significantly weakening your RELATED complaint.

where does it match TIME_WAIT by default?

as for macros for rule management, with iptables you can use whatever tools you want in userspace to create your rules.

the things you are listing as drawbacks don't seem as drastic to me as they seem to appear to you.