asuswrt SYN/ACK not dropped

$ tcpdump host 216.189.149.82 -i ppp0 -vvv     # ppp0 got 5.145.229.190 IP address.
...
now trying to access to banned 216.189.149.82 site from browser:


21:16:55.272233 IP (tos 0x0, ttl 127, id 9276, offset 0, flags [DF], proto TCP (6), length 52)
    5.145.229.190.52140 > 216.189.149.82.https: Flags [S], cksum 0xacb9 (correct), seq 1196045395, win 8192, options [mss 1452,nop,wscale 2,nop,nop,sackOK], length 0
21:16:55.491828 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    216.189.149.82.https > 5.145.229.190.52140: Flags [S.], cksum 0x7332 (correct), seq 2738453799, ack 1196045396, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
21:16:55.523353 IP (tos 0x0, ttl 127, id 9279, offset 0, flags [DF], proto TCP (6), length 52)
    5.145.229.190.52141 > 216.189.149.82.https: Flags [S], cksum 0x6461 (correct), seq 38191534, win 8192, options [mss 1452,nop,wscale 2,nop,nop,sackOK], length 0
21:16:55.739720 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    216.189.149.82.https > 5.145.229.190.52141: Flags [S.], cksum 0xc803 (correct), seq 12485241, ack 38191535, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
21:16:56.491227 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 52)
    216.189.149.82.https > 5.145.229.190.52140: Flags [S.], cksum 0x7332 (correct), seq 2738453799, ack 1196045396, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

6 packets captured
7 packets received by filter
0 packets dropped by kernel