What Is The Analogue of an Ndis Filter in Linux

Why does NdisFSendNetBufferLists only work when called from FilterSendNetBufferLists?

I made it work: The error was in my OriginalNdisFilterHandle. I set it in the function FilterAttach and didn't think that the function gets called multiple times. Because of this the variable had the wrong value.

How does /dev/net/tun works? Do I get back what I write?

How it works? Does /dev/net/tun consumes what I write and not
give it back when I read?

Indeed.
You never get back what was written.

I imagine it works like a file so whatever I write I get back when I read.

No, it works like a device node.
What is written, goes to a device
(in this case - virtual device).
What is read, is read from a (virtual)
device.
Think of /dev/tty: you don't read what
was written there. Instead, you read what
was typed on a keyboard, and what was
written can be seen on a screen.