If there is concern about the overhead of this check it could be moved to the the openshift-iptables-port-proxy service script since that's not called by the runtime.  However, it makes it a lot less useful IMO.  oo-admin-ctl-iptables-port-proxy could add the DNAT rules but if the main INPUT rule isn't there nothing will work.