[xxpor]

Connection tracking != fast path flow tracking in a lot of cases.

[Wheaties466]

well yeah but one of the main reasons for a different path after a syn packet is fast path behavior.

fast path changes the packet flow so it doesn't get processed by all firewall rules.

just explaining the use case for OPs question.