diff --git a/tempesta_fw/http.c b/tempesta_fw/http.c
index 0b6b047c8..7d5cd847c 100644
--- a/tempesta_fw/http.c
+++ b/tempesta_fw/http.c
@@ -5542,8 +5542,8 @@ tfw_http_resp_gfsm(TfwHttpMsg *hmresp, TfwFsmData *data)
 
 error:
 	tfw_http_popreq(hmresp, false);
-	tfw_http_conn_msg_free(hmresp);
-	tfw_http_req_block(req, 502, "response blocked: filtered out");
+	/* The response is freed by tfw_http_req_block(). */
+	tfw_http_req_block(req, 403, "response blocked: filtered out");
 	TFW_INC_STAT_BH(serv.msgs_filtout);
 	return r;
 }
@@ -5603,7 +5603,12 @@ tfw_http_resp_cache(TfwHttpMsg *hmresp)
 	data.skb = NULL;
 	data.req = (TfwMsg *)req;
 	data.resp = (TfwMsg *)hmresp;
-	tfw_gfsm_move(&hmresp->conn->state, TFW_HTTP_FSM_RESP_MSG_FWD, &data);
+	if (tfw_gfsm_move(&hmresp->conn->state, TFW_HTTP_FSM_RESP_MSG_FWD, &data)) {
+		/* The response is freed by tfw_http_req_block(). */
+		tfw_http_req_block(req, 403, "response blocked: filtered out");
+		TFW_INC_STAT_BH(serv.msgs_filtout);
+		return;
+	}
 
 	/*
 	 * Complete HTTP message has been collected and processed
@@ -5648,7 +5653,7 @@ tfw_http_resp_terminate(TfwHttpMsg *hm)
 		TfwHttpReq *req = hm->req;
 
 		tfw_http_popreq(hm, false);
-		tfw_http_conn_msg_free(hm);
+		/* The response is freed by tfw_http_req_block(). */
 		tfw_http_req_block(req, 502, "response blocked: filtered out");
 		TFW_INC_STAT_BH(serv.msgs_filtout);
 		return;
@@ -5885,7 +5890,7 @@ tfw_http_resp_process(TfwConn *conn, TfwStream *stream, const TfwFsmData *data)
 	 */
 	bad_req = hmresp->req;
 	tfw_http_popreq(hmresp, false);
-	tfw_http_conn_msg_free(hmresp);
+	/* The response is freed by tfw_http_req_block/drop(). */
 	if (filtout)
 		tfw_http_req_block(bad_req, 502,
 				   "response blocked: filtered out");
diff --git a/tempesta_fw/http_limits.c b/tempesta_fw/http_limits.c
index 7fde86b24..7ec5cb6a7 100644
--- a/tempesta_fw/http_limits.c
+++ b/tempesta_fw/http_limits.c
@@ -1270,12 +1270,11 @@ frang_resp_fwd_process(TfwHttpResp *resp)
 		FrangGlobCfg *fg_cfg = req->vhost->vhost_dflt
 				? req->vhost->vhost_dflt->frang_gconf
 				: req->vhost->frang_gconf;
-		tfw_cli_conn_close_all_sync((TfwClient *)req->conn->peer);
 		if (fg_cfg->ip_block)
 			tfw_filter_block_ip(&FRANG_ACC2CLI(ra)->addr);
 	}
 
-	return TFW_PASS;
+	return r;
 }
 
 static int