Now we have an example of netfilter for IPv4, you can see when each hook is activated. This is the essence of netfilter. Kernel modules can register to listen at any of these hooks. Upon this foundation, we can build fairly complex packet manipulations, as shown in the next two sections. IP Tables A packet selection system called IP Tables has been built over the netfilter framework.
Kernel modules can register a new table, and ask for a packet to traverse a given table.
This makes things much simpler for users than ipchains was. These are now all done using the NAT framework, rather than being independent entities. The new flexibility provides both the opportunity to do really funky things, but for people to write enhancements or complete replacements that can be mixed and matched.