No, a base chain has only one hook into netfilter.
But within the same table, you can call the same user chain from each base chain. Here's an example, with extra counters showing their state after a single ping -c1 127.0.0.1
:
table inet myfilter {
chain mypreroutingchain {
type filter hook prerouting priority filter; policy accept;
counter packets 2 bytes 168
jump myuserchain
}
chain myinput {
type filter hook input priority filter; policy accept;
counter packets 2 bytes 168
jump myuserchain
}
chain myforward {
type filter hook forward priority filter; policy accept;
counter packets 0 bytes 0
jump myuserchain
}
chain myoutput {
type filter hook output priority filter; policy accept;
counter packets 2 bytes 168
jump myuserchain
}
chain mypostrouting {
type filter hook postrouting priority filter; policy accept;
counter packets 2 bytes 168
jump myuserchain
}
chain myuserchain {
oif "lo" counter packets 4 bytes 336
iif "lo" counter packets 4 bytes 336
counter packets 8 bytes 672
ct state invalid counter packets 0 bytes 0 drop
}
}
the same user chain myuserchain was called 8 times for the ping:
outgoing echo-request: from output+postrouting, incoming echo request from prerouting+input, then again the same with echo-reply.