diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 18e675d..73dcc41 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -25,17 +25,16 @@ table inet router {
 
     chain input {
         type filter hook input priority filter; policy drop;
-        ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle inbound flows"
+        ct state established,related accept comment "defconf: handle inbound flows"
         iif "lo" accept comment "defconf: accept traffic from loopback"
-        ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
         iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
 
     chain forward {
         type filter hook forward priority filter; policy drop;
-        ct state established,related flow add @ft comment "defconf: track forwarded flows"
-        ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle forwarded flows"
+        ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
+        ct state invalid counter drop comment "defconf: drop invalid forwarded flows"
         iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
         iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
@@ -48,9 +47,9 @@ table inet router {
         oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
     }
 
-    chain syn_flood {
-        limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
-        counter drop comment "defconf: drop excess new TCP connections"
+    chain handle_offload {
+        flow add @ft accept comment "defconf: track forwarded flows"
+        accept
     }
 
     chain input_lan {