Dropped packets to port 0

Hello Timotheus ,

Thank you for reaching out to the community, this is due to the default drop, Sophos UTM cannot forward traffic that is sent to a masqueraded WAN IP address unless it was requested by a client behind Sophos UTM, or there is a NAT rule to redirect the traffic to an internal server, with the exception of services running on Sophos UTM itself. If a packet arrives and is not for one of the Sophos UTM's services, is not part of an established connection, and there is no NAT rule for it, it will be dropped as fwrule 60001.

Usually, "fwrule 60001" means that you must configure a NAT rule, likely DNAT, or review the configuration of your existing NAT because the packet does not match the intended rule. Check for interface binding, that the source and destination ports are correct, that you are matching the correct protocol, for example, TCP, UDP, or both, and that the IP addresses are correct.

You can learn more here - Sophos UTM: Packet filter log files.

Hello Timotheus ,

Thank you for reaching out to the community, this is due to the default drop, Sophos UTM cannot forward traffic that is sent to a masqueraded WAN IP address unless it was requested by a client behind Sophos UTM, or there is a NAT rule to redirect the traffic to an internal server, with the exception of services running on Sophos UTM itself. If a packet arrives and is not for one of the Sophos UTM's services, is not part of an established connection, and there is no NAT rule for it, it will be dropped as fwrule 60001.

Usually, "fwrule 60001" means that you must configure a NAT rule, likely DNAT, or review the configuration of your existing NAT because the packet does not match the intended rule. Check for interface binding, that the source and destination ports are correct, that you are matching the correct protocol, for example, TCP, UDP, or both, and that the IP addresses are correct.

You can learn more here - Sophos UTM: Packet filter log files.

Hello Vivek,

thanks for your explanation. That is about what I was expecting. What I am wondering is if there is any way to figure out why these packets are being sent in the first place. I have captured a few using TCPdump, but I don't really know what to make of them.

Perhaps I should just be grateful that everything is working ok and ignore them. But if there is something to learn here I would be interested to find out what is causing the packets to be sent.

Hey Timotheus ,

Yes, there  are couple useful KBAs you may want to check:
> Sophos Firewall: Create and download a packet capture
> Sophos Firewall: How to TCPdump
> Sophos Firewall: Monitor traffic using packet capture
> Sophos Firewall: Monitor dropped packets using CLI