Many connections to port 80 from LAN

RouterOS General
1

I have network with using the routers Mikrotik RB1100AHx2 v6.1
LAN(192.168.67.0/24) ↔ RB1100AHx2-office1 <-VPN-> RB1100AHx2-office2 <-NAT-> Internet
From some LAN-PC I see very many the connections to port 80 (см. файл).
I think these is virus. But have several questions:

  1. How can the external host (Src.address) open session from Internet? There is no destination NAT.
  2. If PC powerOFF connection don’t close. Why?
  3. How can I block these connections?
    connection.jpg
2

Add a filter firewall rule like this

Ip firewall filter add chain=forward scr-address=1.1.1.1 action=drop

Or
Io firewall filter add chain=forward dst-address=1.1.1.1 action=drop

Change 1.1.1.1

Send from my mobile phone using Tapatalk.