The "state RELATED,ESTABLISHED" rule comes before the jump to QUEUE. So if peerguardian is running and a new connections is established, the rule does not match and the traffic ends up in QUEUE. If peerguardian is accepting the traffic, the next time the rule does match and peerguardnf is not consulted anymore.
If, on the other hand, peerguardnf is not running, new connections end up in QUEUE and are dropped.

Ah, I understand, that offloads works from PG (check every good IP only once) while PG is running.
Imagine this: PeerGuardian is not running, no rules are inserted --> every new connection is accepted
PeerGuardian gets started, rules are inserted, connection to bad IP was established before --> Bad IP won't get filtered
Maybe I need to rethink, it's not that big security risk anyway.


Something other: I removed some files from your package manually and they weren't reinstalled by your new package when I did an update:
/etc/default/peerguardnf
/etc/cron.daily/peerguardnf
/etc/logrotate.d/peerguardnf
AFAIK you can mark files as conf-files in Debian-packages. Then at every update the system checks if they were changed/deleted and asks what to do.
jre

You are right. I will try to find a better solution.

That's odd. If you open the package with mc, you can have a look at the DEBIAN folder. Inside you will find a file conffiles that contains all files in /etc/ that are installed by the package. So the package management knows about the configuration files. But I will recheck this on my on machine nonetheless.