Direction=OUT

rands.rodriguez

Hi there,

I've been seeing this thing a lot lately. Any idea what does this one mean?

Regards,

Capture.PNG_thumb

jimp

Usually it means that a packet tried to flow back and the original state had been removed.

You'll see that a lot with squid or some other similar transparent proxy active.

https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection

rands.rodriguez

Hi jimp!

Thanks for the assistance. I'm just wondering why this IP 192.168.0.182 looks like its trying to connect to multiple IP. In my network i see 4 of these IP having this strange connections.

cmb

That particular screenshot looks to be bittorrent traffic blocked out of state, which would explain large numbers of connections and relative frequency of out of state traffic.

rands.rodriguez

I also have these in my pfTop and its scrolling very fast.

![firewall log.jpg](/public/imported_attachments/1/firewall log.jpg)
![firewall log.jpg_thumb](/public/imported_attachments/1/firewall log.jpg_thumb)

Nucleus

Can someone please explain to me why the packets would make it to the LAN adapter if the state was removed?
Shouldn't it be blocked at the WAN adapter and logged as such? Or is it showing the LAN adapter because that was where the state originated?

jimp

Most likely, the NAT state may have still been there (UPnP perhaps?) but the actual firewall state was gone.