When Netfilter performes filtering in TCP/IP kernel network stack?

I have a question about where the Netfilter is placed in the network stack in the Linux kernel.

I know that it is Network layer, netfilter and then TCP layer. In fact, after decapsulating the packet in IP layer in the kernel, it will be parsed by Netfilter and then it will be decapsulated in TCP. So I am wondering how it can filter the packets based on port number as it is in TCP header.

Solution 1:

Netfilter does not route packets, routing takes place in separate part of the network stack.

https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.svg shows the packet flow in the Netfilter subsystem.

Internally Netfilter operates on skb structures, which contain either L2 frames or L3 packets and associated metadata.