Is your feature request related to a problem? Please describe.
Integrating firewall rules with systemd services is difficult or impossible. There are BPF options but they aren't very nice to administrate. Also, kernel's netfilter system for cgroup matching is based on numeric cgroup IDs, which change every time a service is restarted, making them useless in systemd environment. Typically DNS information isn't available for firewalls.

Describe the solution you'd like
PID1, networkd and resolved should optionally put discovered network and cgroup ID information to NFT sets, for use with firewall rules.

• PID1 should put cgroupv2 IDs to NFT sets named using cgroup path like systemd.user.slice/user-1000.slice/user@1000.service/app.slice/, or perhaps to set specified with Service.CGroupNFTSet=systemd-app
• networkd should put interface IP address ranges and possibly other information (at the extreme, same as NetworkManager-dispatcher) to set named for example systemd-eth0-ipv4 or perhaps instead specified with Network.IPv4NFTSet=systemd-eth0-ipv4
• resolved should put DNS information from resolved to set named according to requesting service (see also resolved: access control feature #17126) or explicitly configured

Then the firewall rules can make arbitrarily complex use of the sets. Systemd would not need to gain further firewalling abilities besides the rather simple management of specific NFT sets.

Example NFT rules:

table inet filter {
        set systemd-eth0-ipv4 {
                type ipv4_addr;
                flags interval;
        }
        set systemd-app {
                type integer;
        }
        set systemd-timesyncd {
                type ipv4_addr;
        }

        chain service_x_input {
                ip saddr @systemd-eth0-ipv4 counter accept
                counter drop
        }
        chain service_y_input {
                meta cgroup @systemd-app counter accept
                counter drop
        }
        chain systemd_timesyncd_output {
                ip daddr @systemd-timesyncd counter accept
                counter reject with icmpx admin-prohibited
        }
}

Related discussion in #7327 and #21899.

Describe alternatives you've considered
Daemons to manage cgroup IDs:
https://github.com/helsinki-systems/nft_cgroupv2/
https://github.com/mk-fg/systemd-cgroup-nftables-policy-manager

IPSet module for Unbound DNS puts resolved A and AAAA addresses to IPSet (but it can't identify the calling service):
https://github.com/NLnetLabs/unbound/blob/master/ipset/ipset.c