netfilter: allow NFQUEUE bypass if no listener is available