diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index 0e6d9f9..10c7b63 100644
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -1,10 +1,13 @@
 /*
+ * (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org>
  * (C) 2013 by Giuseppe Longo <giuseppelng@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
  */
 
 #include <stdio.h>
@@ -14,6 +17,7 @@
 #include <net/if_arp.h>
 
 #include <xtables.h>
+#include <libiptc/libxtc.h>
 #include <net/if_arp.h>
 #include <netinet/if_ether.h>
 
@@ -161,6 +165,9 @@
 {
 	struct arpt_entry *fw = data;
 	uint8_t flags = arpt_to_ipt_flags(fw->arp.invflags);
+	struct xt_entry_target *t;
+	char *targname;
+	int ret;
 
 	if (fw->arp.iniface[0] != '\0')
 		add_iniface(r, fw->arp.iniface, flags);
@@ -207,7 +214,28 @@
 		add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
 			 &fw->arp.tgt.s_addr, 4, flags);
 
-	return 0;
+	/* Counters need to me added before the target, otherwise they are
+	 * increased for each rule because of the way nf_tables works.
+	 */
+	if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
+		return -1;
+
+	t = nft_arp_get_target(fw);
+	targname = t->u.user.name;
+
+	/* Standard target? */
+	if (strcmp(targname, XTC_LABEL_ACCEPT) == 0)
+		ret = add_verdict(r, NF_ACCEPT);
+	else if (strcmp(targname, XTC_LABEL_DROP) == 0)
+		ret = add_verdict(r, NF_DROP);
+	else if (strcmp(targname, XTC_LABEL_RETURN) == 0)
+		ret = add_verdict(r, NFT_RETURN);
+	else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL)
+		ret = add_target(r, t);
+	else
+		ret = add_jumpto(r, targname, NFT_JUMP);
+
+	return ret;
 }
 
 static uint16_t ipt_to_arpt_flags(uint8_t invflags)
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 2142a2e..3be801d 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -22,11 +22,13 @@
 
 #include <linux/netfilter/nf_tables.h>
 
+#include "nft.h"
 #include "nft-shared.h"
 
 static int nft_ipv4_add(struct nft_rule *r, void *data)
 {
 	struct iptables_command_state *cs = data;
+	struct xtables_rule_match *matchp;
 	uint32_t op;
 
 	if (cs->fw.ip.iniface[0] != '\0')
@@ -63,7 +65,18 @@
 
 	add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags);
 
-	return cs->fw.ip.flags;
+	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+		if (add_match(r, matchp->match->m) < 0)
+			break;
+	}
+
+	/* Counters need to me added before the target, otherwise they are
+	 * increased for each rule because of the way nf_tables works.
+	 */
+	if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
+		return -1;
+
+	return add_action(r, cs, cs->fw.ip.flags);
 }
 
 static bool nft_ipv4_is_same(const void *data_a,
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index dbb148a..e3784a8 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -20,11 +20,13 @@
 
 #include <xtables.h>
 
+#include "nft.h"
 #include "nft-shared.h"
 
 static int nft_ipv6_add(struct nft_rule *r, void *data)
 {
 	struct iptables_command_state *cs = data;
+	struct xtables_rule_match *matchp;
 
 	if (cs->fw6.ipv6.iniface[0] != '\0')
 		add_iniface(r, cs->fw6.ipv6.iniface, cs->fw6.ipv6.invflags);
@@ -46,7 +48,18 @@
 
 	add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
 
-	return cs->fw6.ipv6.flags;
+	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+		if (add_match(r, matchp->match->m) < 0)
+			break;
+	}
+
+	/* Counters need to me added before the target, otherwise they are
+	 * increased for each rule because of the way nf_tables works.
+	 */
+	if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
+		return -1;
+
+	return add_action(r, cs, cs->fw6.ipv6.flags);
 }
 
 static bool nft_ipv6_is_same(const void *data_a,
diff --git a/iptables/nft.c b/iptables/nft.c
index d08a513..c3784c0 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -589,7 +589,7 @@
 	return 0;
 }
 
-static int add_match(struct nft_rule *r, struct xt_entry_match *m)
+int add_match(struct nft_rule *r, struct xt_entry_match *m)
 {
 	struct nft_rule_expr *expr;
 	int ret;
@@ -671,6 +671,32 @@
 	return 0;
 }
 
+int add_action(struct nft_rule *r, struct iptables_command_state *cs,
+	      int ip_flags)
+{
+       int ret = 0;
+
+       /* If no target at all, add nothing (default to continue) */
+       if (cs->target != NULL) {
+	       /* Standard target? */
+	       if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
+		       ret = add_verdict(r, NF_ACCEPT);
+	       else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
+		       ret = add_verdict(r, NF_DROP);
+	       else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
+		       ret = add_verdict(r, NFT_RETURN);
+	       else
+		       ret = add_target(r, cs->target->t);
+       } else if (strlen(cs->jumpto) > 0) {
+	       /* Not standard, then it's a go / jump to chain */
+	       if (ip_flags & IPT_F_GOTO)
+		       ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
+	       else
+		       ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
+       }
+       return ret;
+}
+
 static void nft_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh)
 {
 #ifdef NLDEBUG
@@ -707,11 +733,9 @@
 
 static struct nft_rule *
 nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
-	     struct iptables_command_state *cs)
+	     void *data)
 {
 	struct nft_rule *r;
-	int ret = 0, ip_flags = 0;
-	struct xtables_rule_match *matchp;
 
 	r = nft_rule_alloc();
 	if (r == NULL)
@@ -721,39 +745,7 @@
 	nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table);
 	nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain);
 
-	ip_flags = h->ops->add(r, cs);
-
-	for (matchp = cs->matches; matchp; matchp = matchp->next) {
-		if (add_match(r, matchp->match->m) < 0)
-			goto err;
-	}
-
-	/* Counters need to me added before the target, otherwise they are
-	 * increased for each rule because of the way nf_tables works.
-	 */
-	if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
-		goto err;
-
-	/* If no target at all, add nothing (default to continue) */
-	if (cs->target != NULL) {
-		/* Standard target? */
-		if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
-			ret = add_verdict(r, NF_ACCEPT);
-		else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
-			ret = add_verdict(r, NF_DROP);
-		else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
-			ret = add_verdict(r, NFT_RETURN);
-		else
-			ret = add_target(r, cs->target->t);
-	} else if (strlen(cs->jumpto) > 0) {
-		/* Not standard, then it's a go / jump to chain */
-		if (ip_flags & IPT_F_GOTO)
-			ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
-		else
-			ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
-	}
-
-	if (ret < 0)
+	if (h->ops->add(r, data) < 0)
 		goto err;
 
 	return r;
@@ -2393,56 +2385,6 @@
  * to ARP. These functions should go away with some refactoring of the
  * existing infrastructure.
  */
-static struct nft_rule *
-nft_arp_rule_new(struct nft_handle *h, const char *chain, const char *table,
-	     struct arpt_entry *fw)
-{
-	struct xt_entry_target *t;
-	char *targname;
-	struct nft_rule *r;
-	int ret = 0;
-
-	t = nft_arp_get_target(fw);
-	targname = t->u.user.name;
-
-	r = nft_rule_alloc();
-	if (r == NULL)
-		return NULL;
-
-	nft_rule_attr_set_u32(r, NFT_RULE_ATTR_FAMILY, h->family);
-	nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table);
-	nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain);
-
-	h->ops->add(r, fw);
-
-	/* Counters need to me added before the target, otherwise they are
-	 * increased for each rule because of the way nf_tables works.
-	 */
-	if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
-		goto err;
-
-	/* Standard target? */
-	if (strcmp(targname, XTC_LABEL_ACCEPT) == 0)
-		ret = add_verdict(r, NF_ACCEPT);
-	else if (strcmp(targname, XTC_LABEL_DROP) == 0)
-		ret = add_verdict(r, NF_DROP);
-	else if (strcmp(targname, XTC_LABEL_RETURN) == 0)
-		ret = add_verdict(r, NFT_RETURN);
-	else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL)
-		ret = add_target(r, t);
-	else
-		ret = add_jumpto(r, targname, NFT_JUMP);
-
-	if (ret < 0)
-		goto err;
-
-	return r;
-err:
-	nft_rule_free(r);
-	return NULL;
-
-}
-
 static void
 nft_arp_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh) {
 #ifdef NLDEBUG
@@ -2464,7 +2406,7 @@
 	struct nft_rule *r;
 	int ret = 1;
 
-	r = nft_arp_rule_new(h, chain, table, fw);
+	r = nft_rule_new(h, chain, table, fw);
 	if (r == NULL) {
 		ret = 0;
 		goto err;
@@ -2507,7 +2449,7 @@
 
 	nft_fn = nft_arp_rule_append;
 
-	r = nft_arp_rule_new(h, chain, table, fw);
+	r = nft_rule_new(h, chain, table, fw);
 	if (r == NULL) {
 		ret = 0;
 		goto err;
diff --git a/iptables/nft.h b/iptables/nft.h
index 09d3e0c..8ddde48 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -100,8 +100,10 @@
  */
 int add_counters(struct nft_rule *r, uint64_t packets, uint64_t bytes);
 int add_verdict(struct nft_rule *r, int verdict);
+int add_match(struct nft_rule *r, struct xt_entry_match *m);
 int add_target(struct nft_rule *r, struct xt_entry_target *t);
 int add_jumpto(struct nft_rule *r, const char *name, int verdict);
+int add_action(struct nft_rule *r, struct iptables_command_state *cs, int ip_flags);
 
 enum nft_rule_print {
 	NFT_RULE_APPEND,