This is not a "feature", it's just a by-product of how iptables works. The alternative would be to have a proxy run in userspace, instead of letting the kernel forward packets