First, understand that in Linux, TCP/IP sending, receiving, and forwarding are done in the kernel. So everything networking related is kernel modules that either have to be built into the kernel or
modprobed after boot.
Quoting from http://www.netfilter.org/: "netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack."
What this means is that Netfilter is just a bunch of "openings" in the kernel that lets someone create and plug-in other code that changes how Linux does anything related to networking.
Further from the article: "iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists of a number of classifiers (iptables matches) and one connected action (iptables target)."
iptables is a specific project and a set of kernel modules that takes advantage of the the "openings" provided by Netfilter to implement rule-by-rule based packet filtering (also known as firewalling) and a lot more.
iptables will 1) hook itself into Netfilter, and intercept network packets the kernel was either about to send to a NIC or send to an application, and 2) process this packet against each of its current set of rules and 3) when a rule matches, send the packet to that rule's target.
With properly configured rules you can then drop certain packets coming in from the NIC, change packets to implement NAT or port redirection, or just take action depending on protocol-specific content of the packet, or the payload contents of the packet. You can also write rules that hand the packet to a userspace application (this is the
NFQUEUE target) for further processing (userspace-based filters like
moblock use this).
I'm not a Linux kernel expert, but I believe there's one main
iptables module that handles adding/deleting rules and this is what the
iptables user space application talks to. Pretty much every target is then handled by its own kernel module that can either exist as a separate module or be built into the kernel.
You can look for yourself. Download a kernel from
www.kernel.org, un-bzip2-it, cd into its directly and do a
make menuconfig. Drill down starting with "Networking Support" and you'll be able to see all the modules available for iptables.