diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 4e3dafd..18e675d 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -25,7 +25,7 @@ table inet router {
 
     chain input {
         type filter hook input priority filter; policy drop;
-        ct state established,related accept comment "defconf: handle inbound flows"
+        ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle inbound flows"
         iif "lo" accept comment "defconf: accept traffic from loopback"
         ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
@@ -73,6 +73,7 @@ table inet router {
     }
 
     chain accept_to_lan {
+        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
         oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }