What would a "pure iptables front end" be and how would it learn about connection attempts? (Serious question, it's quite possible I'm forgetting an API)

The used technique, redirecting initial packets to a netfilter queue and then marking the connection to offload further processing to the kernel seems like a reasonable way to do this from userspace.

I don't know enough about Linux networking - I didn't realise the distinction between iptables and netfilter. Off to do some reading - thanks.

(I interpreted "iptables frontend" as probably meaning something that just generates iptables rules, that's why I was asking)

netfilter is the underlying kernel infrastructure, that's used e.g. by iptables to set rules for packets. From this https://github.com/evilsocket/opensnitch/blob/master/opensni..., it looks like OpenSnitch uses iptables to set rules so that the kernel delivers outgoing packets that don't belong to an existing connection to a queue. It then can use said queue to only intercept those packets – if it lets them pass, a connection will be created and further packets will not be passed to/handled by OpenSnitch. It touches the first packet of each outgoing connection, but not all traffic.

Connection requests shouldn't be a performance issue on a standard desktop.