I want to do a decent setup of the firewall on a PVE host. Is nftables still experimental? I'd rather move forward then first setup iptables and migrate later. Secondly, is there a decent documentation of setting this up while protecting yourself against a lockout?