Comment 1 for bug 2072406

I found a comment in

https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains

telling:

Each nftables base chain is assigned a priority that defines its ordering among other base chains, flowtables, and Netfilter internal operations at the same hook. For example, a chain on the prerouting hook with priority -300 will be placed before connection tracking operations.

NOTE: If a packet is accepted and there is another chain, bearing the same hook type and with a later priority, then the packet will subsequently traverse this other chain. Hence, an accept verdict - be it by way of a rule or the default chain policy - isn't necessarily final. However, the same is not true of packets that are subjected to a drop verdict. Instead, drops take immediate effect, with no further rules or chains being evaluated.

which confirms my observation and the cited comment.

This is broken by design. You cannot have regular firewall rules and service enabling rules (like LXD) at the same time.