firewall: add more pscan matches and filter INVALID conntrack packages.