diff --git a/runtime/syntax/nftables.yaml b/runtime/syntax/nftables.yaml
index a477fadec..aa63825b2 100644
--- a/runtime/syntax/nftables.yaml
+++ b/runtime/syntax/nftables.yaml
@@ -1,19 +1,25 @@
 filetype: nftables
 
 detect:
-    filename: "nftables.conf$"
+    filename: "(nftables\\.(conf|rules)$|nftables(\\.rules)?\\.d/)"
     header: "^(#!.*/(env +)?nft( |$)|flush +ruleset)"
-    
+
 rules:
     - type: "\\b(chain|counter|map|rule|ruleset|set|table)\\b"
-    - type: "\\b(ether|icmp|icmpv6|icmpx|inet|ip|ip6|ipv4|ipv6|tcp|udp)\\b"
-    - special: "\\b(elements|hook|policy|priority|type)\\b"
-    - identifier: "\\b(ct|iif|iifname|meta|oif|oifname|th)\\b"
-    - statement: "\\b(accept|drop|goto|jump|log|masquerade|reject)\\b"
+    - type: "\\b(ether|inet|i(cm)?p(x|(v?(4|6))?)|tcp|udp|8021q)\\b"
+    - special: "\\b(elements|hook|policy|priority|type|state)\\b"
+    - identifier: "\\b(ct|iif|iifname|meta|oif|oifname|th|dport|sport|saddr|daddr|l4proto)\\b"
+    - statement: "\\b(accept|drop|goto|jump|log|masquerade|reject|limit|queue)\\b"
     - preproc: "\\b(add|define|flush|include|delete)\\b"
-    - symbol: "[-=/:;,@]"
-    - symbol.operator: "[<>.&|^!]|\\b(and|ge|gt|le|lt|or|xor)\\b"
-    - constant.string: '([\"]{1})(.*)([\"]{1})'
+    - symbol.operator: "[<>.&|^!=:;,@]|\\b(and|ge|gt|le|lt|or|xor)\\b"
+      # string constants
+    - constant.string: '([\+\-\*/][\"]{1})(.*)([\"]{1})'
+    - constant.string:
+        start: "\""
+        end: "\""
+      # Integer Constants
+    - constant.number: "\\b([0-9]+)\\b"
+    - constant.number: "\\b(0x[0-9a-fA-F]+)\\b"
     - identifier.var: "[$@][a-zA-Z_.][a-zA-Z0-9_/.-]*"
     - comment: "(^|[[:space:]])#([^{].*)?$"
     - indent-char.whitespace: "[[:space:]]+$"