Both NFTables and IPTables use the Netfilter framework provided in the Linux kernal. NFtables was implemented to supersede IPTables, which due to the widespread use of IPTables, will probably take a long time.

The following is a basic block diagram of the Netfilter Filter and NAT (Network Address Translation) functions, which are the basic requirements for router.

       Incoming
       Packets
          |
    ┌────────────┐
    │ Prerouting │
    │ Rules      │
    └────────────┘
          |
     /----------\
     | Routing  |       NAT
     | Decision |-----------------|
     |  Rules   |       Filter    |
     \----------/                 |
           |                      |
    |------------|                |
    | Input      |                |
    | Rules      |                |
    |------------|                |
           |                      |
 |-------------------|      |----------|
 | Network Processes |      | Forward  |
 | within Router     |      | Rules    |
 |-------------------|      |----------|
           |                      |
    |------------|                |
    | Output     |                |
    | Rules      |                |
    |------------|                |
           |            FILTER    |
           |   |------------------|
           |   |        NAT
    |-------------|
    | Postrouting |
    | Rules       |
    |-------------|   
           |
       Outgoing
       Packets

Some references:

• Netfilter.org iptables how to Saying how to mangle the packets
• iptables(8) - Linux man page
• The iptables Rate-Limiting Module
• Nixcraft IPTables allow or block ICMP ping request
• Limit the rate of inbound TCP connections using iptables
• iptables: How to use the limits module
• Using iptables to rate-limit incoming connections
• The Geek Stuff:
  • Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals
  • 25 Most Frequently Used Linux IPTables Rules Examples
  • Fail2Ban Howto: Block IP Address Using Fail2ban and IPTables
  • iptables script
• Geek Stuff/iptables: Spammers are Annoying, Right?
• Cisco General Design Considerations for Secure Networks
• Oregon Tech icmp.txt