only update nf_conntrack_max if firewall is started
use RETURN instead of ACCEPT to allow further processing
do not use perl -w
use perl taint mode