netfilter: Mark SYN/ACK packets as invalid from original direction