cleaned up - a lot git status! - connection tracking and invalid packets are now ONLY in INPUT