Is there a user-friendly wrapper or GUI for nftables?

Have a look at firewalld and its firewall-config GUI. Firewalld provides a higher-level way to manage zones and can use nftables as its backend, so you do not necessarily have to choose one or the other.

Check availability and service setup on Void before committing to it. Also check how it interacts with the rules Incus manages, rather than assuming the GUI will show every part of the container networking setup in a convenient form.

For a lab, I would also consider sticking with nftables config files and using Ansible to push them to the hosts or containers that need them. Well-organized text files make it easier to see and review the intended rules, and you can keep them under version control.

That does not solve the discovery problem a GUI might help with. But it gives you a repeatable way to deploy changes while you learn the native syntax. Review generated rules before applying them, especially if you are relying on an AI tool to write them.

Shorewall is another option if a readable configuration format matters more than a graphical interface. It uses higher-level configuration to generate firewall rules and supports variables. Its safe-apply feature is also useful when a bad change might lock you out.

Check its current backend support and Void packaging before choosing it, though. A wrapper is not automatically an nftables front end.

For troubleshooting the container side, Edgeshark may be useful alongside a firewall tool. It gives you a graphical view of networks and interfaces and can open live captures in Wireshark. It is not an nftables rule editor, but seeing where traffic is going can help narrow down a problem.

UFW is worth checking if you mostly want a simpler command-line interface for basic firewall changes. I would compare its features and backend setup with the zone-heavy labs you have in mind before settling on it.