If I turn on logging/blocking of invalid forward traffic in this intermediate router I get a lot of packets that seem to be legit but are being marked as invalid.
For now I am allowing it in case it causes problems for our customers so I hope someone might be able to explain why I am seeing this.
To clarify this router is running PPPoE Server serving public IPs to PPPoE customers. Each customer is running their own consumer grade firewall and NAT
The router in the screenshot is not doing any NAT
The traffic looks legitimate so I am trying to establish why it is being marked as INVALID.