I have a basic firewall ruleset with some very elementary rules at the top of the list as follows…
add action=log chain=input connection-state=invalid log-prefix=XXXXX_INVALID_IN protocol=!icmp
add action=drop chain=input connection-state=invalid
add action=log chain=forward connection-state=invalid log-prefix=XXXXX_INVALID_FWD
add action=drop chain=forward comment="END of INVALID STATE handling" connection-state=invalid
And as a result of the log rule I constantly see the following…
XXXXX_INVALID_FWD forward: in:ether2-lan out:pppoe-out1, src-mac 50:46:5d:a1:f6:3b, proto TCP (ACK,FIN), 192.168.1.251:49222->74.125.202.109:993, len 40
So my question is why is the “ACK,FIN” considered in an invalid state and should I be dropping this packet?
I know that a Windows client running Thunderbird Email is talking to a Google IMAP server every few minutes but why is it invalid.
I am running ROS 6.31.