What is netfilter?

netfilter (the Linux kernel's packet-filtering framework) is the set of hooks every packet passes through, where firewall, NAT and connection-tracking rules run.

A packet arriving on an interface first meets the prerouting hook. The kernel then makes its routing decision: packets for the machine itself go to the input hook, and packets to be routed elsewhere go to forward. Packets the machine sends start at output, and everything leaving passes postrouting last. Tools attach chains of rules to these hooks, each with a priority that decides the order when several chains share a hook. Every chain on a hook must let a packet through; a drop in any of them is final. Connection tracking (conntrack) and NAT are part of the same framework, which is how a firewall rule can match "replies to connections we allowed" and how masquerade rewrites replies on the way back.

You rarely use netfilter by name. You use a tool that loads rules into it: nftables today, or iptables, which on current distributions writes nftables rules underneath. Docker, fail2ban and libvirt also load rules into netfilter, which is why one machine's firewall can be made of several tables written by different programs. The nftables and iptables on Debian lesson walks a packet through the hooks with nft monitor trace.