Packets hitting the Network or Broadcast addresses don't get covered by a ANY rule. You'd need another rule to Allow them (although there's not point unless you're bridging) or Drop them with or without logging.
Normally I drop internal broadcasts without logging.
These were coming from the outside and hitting external IPs.
Ohhh, wait a minute. Those were to Additional Addresses on ports NOT relayed by my DNAT rule; of course they were dropped - where was the poor firewall gonna send those messages anyway?
