Packets hitting the Network or Broadcast addresses don't get covered by a ANY rule. You'd need another rule to Allow them (although there's not point unless you're bridging) or Drop them with or without logging.
Normally I drop internal broadcasts without logging.
These were coming from the outside and hitting external IPs.
Ohhh, wait a minute. Those were to Additional Addresses on ports NOT relayed by my DNAT rule; of course they were dropped - where was the poor firewall gonna send those messages anyway?
Pay no attention to the man behind the curtain!*
Cheers - Bob
*A "Wizard of Oz" reference.
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
