Make your sniffer push rules on the firewall as needed... or use a firewall like Netfilter that can be controlled from user space using some library (libnetfilter_conntrack) or tool (conntrack-tools).

In any case, using a reverse proxy in front of your web server would be far easier.