Rules live in chains inside tables; base chains attach to netfilter hooks. It is the successor of iptables.