re-enable more limited conntrack