diff --git a/templates/nftables.conf.j2 b/templates/nftables.conf.j2
index b09491f..fb9c250 100644
--- a/templates/nftables.conf.j2
+++ b/templates/nftables.conf.j2
@@ -30,7 +30,7 @@ table inet filter {
 
 		iif lo accept comment "Accept any localhost traffic"
 		ct state invalid drop comment "Drop invalid connections"
-		ct state established,related accept comment "Accept traffic originated from us"
+		ct state established,related accept comment "Accept established (statefull)"
 
 		ip6 nexthdr icmpv6 accept comment "Accept ICMPv6"
 		ip protocol icmp accept comment "Accept ICMP"
@@ -45,6 +45,9 @@ table inet filter {
 		type filter hook forward priority 0;
 		policy {{ firewall.policies.forward }};
 
+		ct state invalid drop comment "Drop invalid connections"
+		ct state established,related accept comment "Accept established (statefull)"
+
 {{ nftchain('forward') }}
 
 		counter comment "Count dropped"