Why does psql open two tcp connections to PostgreSQL?
This double connection depends on whether a password has to be submitted by the client (according to pg_hba.conf) and, if yes, whether the -W option is passed to psql. 

In fact avoiding that second connection attempt is the only raison d'être of this option. According to psql manpage:


  -W
  --password
  
  Force psql to prompt for a password before connecting to a database.
  
  This option is never essential, since psql will automatically prompt for a password if the server demands password authentication.
  However, psql will waste a connection attempt finding out that the
  server wants a password. In some cases it is worth typing -W to avoid
  the extra connection attempt.
  
  Note that this option will remain set for the entire session, and so it affects uses of the meta-command \connect as well as the initial
  connection attempt.


I think that with this log from iptables, you're just noticing the mentioned "wasted connection attempt".
Note the time elapsed between the two connections:
[598519.458578] and [598520.875428]. Presumably this is the time it took you to enter the password: about 1.42 seconds.

If you try the same test with -W it should ask the password before attempting the connection and make only one connection.