I know that to do kernel debug I need 2 OS,the hosting OS and the target OS.
but does a netfilter service(ndis filter,to be exact) belong to the kernel?
Yes. NDIS filters are loaded into kernel mode. There is an almost identical question already here. Kernel debugging techniques have to be applied.