Run the app in a separate netns and then you can create iptables/netfilter rules that match on that netns.