I'm looking for a fast stateful firewall in Linux that may process lots of packets and send some of them to external programs.
Is it possible to make netfilter (iptables, nftables) working with Intel DPDK in order to improve performance?
DPDK has a "Kernel Network Interface" that works somewhat like a tap/tun device, but is zero-copy. Using these, you can do your RX/TX in userspace and then pass packets into the linux network stack. I don't know if this would buy you much performance aside from possibly removing some IRQ overhead.
Some other options, if you're not married to netfilter, could be to use one the userspace BSD network stacks (e.g. libuinet) or a rump kernel on top of DPDK.