@thedarktangent @hrbrmstr the nftset can have an expiry time associated with it, entries not touched get pruned.
For eg a curl “one and done” lookup+connect, set the timeout to say 5s, long enough for the 3-way handshake to end up in conntrack, then you can drop the entry, established connections are usually allowed to continue.