I came across the following in Mikrotik log: invalid forward: in:bridge out:ether1, src-mac xx…, proto TCP (RST), 10.0.0.204:57914->23.3.109.12:443, len 40 (iphone to an Akamai) invalid forward: in:bridge out:ether1, src-mac …, proto TCP (ACK,FIN), 10.0.0.152:60806->54.173.8.102:80, len 52 (amaz…

invalid forward: in:bridge out:ether1, src-mac xx…, proto TCP (RST), 10.0.0.204:57914->23.3.109.12:443, len 40 invalid forward: in:bridge out:ether1, src-mac …, proto TCP (ACK,FIN), 10.0.0.152:60806->54.173.8.102:80, len 52 Really depends on context … It is expected to happen right after route…

I came across the following in Mikrotik log: invalid forward: in:bridge out:ether1, src-mac xx…, proto TCP (RST), 10.0.0.204:57914->23.3.109.12:443, len 40 (iphone to an Akamai) invalid forward: in:bridge out:ether1, src-mac …, proto TCP (ACK,FIN), 10.0.0.152:60806->54.173.8.102:80, len 52 (am…

Thus is caused by the premature deletion of the connection entry for TCP in Linux. When the router sees a close of the TCP session (FIN/ACK FIN) it immediately deletes the connection entry, instead of setting it to a timeout of say 30 seconds. The result is that when the ACK FIN is not received …

What do you mean with “ignore (not drop)”? As I said, the easiest is to remove the log flag on that rule. In a NAT router, you can also consider removing the entire rule. It does not really accomplish much: invalid traffic from WAN would be blocked because of the NAT anyway.

Future reference: https://www.alibabacloud.com/blog/tcp-connection-analysis-why-the-socket-remains-in-the-fin-wait-1-state-post-killing-the-process_595798 http://forum.mikrotik.com/t/connection-tracking-timeout-values/77167/1

MikroTik community forum

Firewall: Invalid forward packets, unknown input

RouterOS Beginner Basics

ZupoLlask October 30, 2022, 10:00am 6

Future reference:

https://www.alibabacloud.com/blog/tcp-connection-analysis-why-the-socket-remains-in-the-fin-wait-1-state-post-killing-the-process_595798
http://forum.mikrotik.com/t/connection-tracking-timeout-values/77167/1