Why does this need nf_queue? Wouldn't it be sufficient to directly filter the connect syscalls using eBPF?
Dropping packets using netfilter makes many applications wait for a timeout. I prefer reject to filter unwanted outbound connections so that applications don't wait.