> The other thing worthy of note is that it appears every single packet will need to be processed through this application No, only the initial connection requ

> The other thing worthy of note is that it appears every single packet will need to be processed through this application No, only the initial connection requests will go into the netfilter queue (as well as DNS requests so that it knows what a particular IP actually refers to). Packets sent as part of a connection aren't vetted, and it uses the marking feature of netfilter so all of the actual filtering is done by the kernel.