What's the best layer for modify remote address/port of inbound udp datagram in WFP ?

According to my understanding of the document, the alternative is in the red box.