How do iptables and nftables handle packet filtering rules?

iptables organizes rules into tables (filter, nat, mangle, raw) and chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING). Packets traverse chains top-to-bottom; the first matching rule's target (ACCEPT, DROP, REJECT, LOG, MASQUERADE) is applied. Rule ordering is critical — more specific rules must come before general ones. iptables -I INPUT 1 ... inserts at position 1 (top). The stateful matching module (-m conntrack --ctstate) replaces the older -m state module. nftables (introduced in kernel 3.13, default on modern distros) replaces all four iptables tools with one unified framework, using a cleaner grammar, atomic rule updates (no mid-update inconsistency), and better performance via a virtual machine in the kernel. Migrate with iptables-translate. Both ultimately configure netfilter hooks in the kernel.