Drop Invalid vs. Drop "all"

I don't think this is correct. According to ROS packet flow, both connection tracking and SRC-NAT are part of prerouting part of packet flow ... but connection tracking comes first, connection state gets updated on home router even before SRC-NAT does its magic. Firewall filter comes much later (towards the end of forward part of packet flow) and dropping a packet there doesn't affect the connection state.

If you're writing about remote router failing to SRC-NAT certain packet ... well, in that case connection tracking machinery can't guess that he RST (or FIN) packet arriving from some RFC1918 address (with non-translated src-port as well!) belongs to some particular connection, can it?


The rule "invalid" do not consider

Do you mind to elaborate this further? The way I understand things these are exactly cases of invalid packet and fikter rule would drop them.