Drop packages

Question

Hi, 
 
 We have a DNAT rule that allow us to access our server with RDP from internet with different port number, the rule working correctly, but in the logs we can see lots of drop UDP connections from the the IP address and port number that we try to access the server with RDP. 
 what are these UDP packages? why should the we see incoming UDP packages at all?

kerobra_retired · Accepted Answer

You can use one for both protocols as well as one for each protocol. The default definition on the UTM only covers the TCP protocol. As in your picture here 
 
 you can easier see which part of the rule is making problems when you are using two different DNAT rules (see the the white entries in your pic, these are only displayed when "log initial packets" is ticked). 
 For the firewall part you need only one rule for TCP / UDP using port 3389 for each server. Therefore I wouln'd tick the "automatic firewall rule" thing.

BAlfson · Answer

I will guess that your DNAT violates #4 in Rulz . 
 Cheers - Bob

BAlfson · Answer

That was the other possibility as UThomas suggested. Make a new Service with TCP/UDP and you'll be golden. 
 Cheers - Bob

BAlfson · Answer

Ah, I see now, thanks, Aresh. My guess is that the Host object "-----server" in 'Change the destination to' is not defined correctly. Take a look at #3 in Rulz . The clue is fwrule="60002" in the log line. 
 Cheers - Bob