Abusing Linux's firewall: the hack that allowed us to build Spectrum
Author here. TPROXY module is pretty special, it really would have been hard to handle any inbound port without it. I guess it shows that there are benefits in keeping firewall and network stack code tied close.