The forward chain has only information on outgoing interface. So we must try to figure out where the packet came from. This makes the firewalling code way too complex. The concept of the netfilter framework and most of its implementation were done by Rusty Russell. He is co-author if ipchains and is the current Linux Kernel IP firewall maintainer.
Packets come in from the left.
Next they enter the routing code, which decides if the packets are local or have to be passed to another interface. Now we have an example of netfilter IPv4, you can see how each hook is activated. Kernel modules can register for one or more of this hook and get called for each packet traversing the hook. A packet selection system called IP tables has been built based on the netfilter framework. It is a direct descendant of ipchains, with extensibility.