Next they enter the routing code, which decides if the packets are local or have to be passed to another interface. Now we have an example of netfilter IPv4, you can see how each hook is activated. Kernel modules can register for one or more of this hook and get called for each packet traversing the hook. A packet selection system called IP tables has been built based on the netfilter framework. It is a direct descendant of ipchains, with extensibility.
Kernel modules can register a new table, and ask for a packet to traverse a given table.
The three big parts of Linux 2.4 packet handling are built using netfilter hooks and IP tables. They are seperate modules and are independent from each other. They all plug in nicely in the infrastructure provided by netfilter. Packet filtering This table 'filter' should never alter packets, only filter them. Therefore, for each packet there is one, and only one, place to filter it.