Basic Netfilter Function Block Diagram

Both NFTables and IPTables use the Netfilter framework provided in the Linux kernal. NFtables was implemented to supersede IPTables, which due to the widespread use of IPTables, will probably take a long time.

The following is a basic block diagram of the Netfilter Filter and NAT (Network Address Translation) functions, which are the basic requirements for router.

       Incoming
       Packets
          |
    ┌────────────┐
    │ Prerouting │
    │ Rules      │
    └────────────┘
          |
     /----------\
     | Routing  |       NAT
     | Decision |-----------------|
     |  Rules   |       Filter    |
     \----------/                 |
           |                      |
    |------------|                |
    | Input      |                |
    | Rules      |                |
    |------------|                |
           |                      |
 |-------------------|      |----------|
 | Network Processes |      | Forward  |
 | within Router     |      | Rules    |
 |-------------------|      |----------|
           |                      |
    |------------|                |
    | Output     |                |
    | Rules      |                |
    |------------|                |
           |            FILTER    |
           |   |------------------|
           |   |        NAT
    |-------------|
    | Postrouting |
    | Rules       |
    |-------------|   
           |
       Outgoing
       Packets

Some references:

• Netfilter.org iptables how to Saying how to mangle the packets
• iptables(8) - Linux man page
• The iptables Rate-Limiting Module
• Nixcraft IPTables allow or block ICMP ping request
• Limit the rate of inbound TCP connections using iptables
• iptables: How to use the limits module
• Using iptables to rate-limit incoming connections
• The Geek Stuff:
  • Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals
  • 25 Most Frequently Used Linux IPTables Rules Examples
  • Fail2Ban Howto: Block IP Address Using Fail2ban and IPTables
  • iptables script
• Geek Stuff/iptables: Spammers are Annoying, Right?
• Cisco General Design Considerations for Secure Networks
• Oregon Tech icmp.txt