I'd like to understand what the following line means exactly, because similar lines can by found in my system log pretty often and I would not expect any.
[UFW BLOCK] IN=enp2s0 OUT= MAC=72:8a:bd:21:93:eb:00:02:2a:00:6c:c5:08:99 SRC=18.104.22.168 DST=192.168.0.75 LEN=28 TOS=0x00 PREC=0x00 TTL=241 ID=50074 PROTO=UDP SPT=60000 DPT=52346 LEN=8
UFW has the following status, all my ports should be closed:
Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip
My PC has a local IP (192.168.x.x) and is behind a router facing the public internet that has no rules enabled for NAT, so I suppose all ports are closed and no traffic is supposed reach the local network. I'm not sure I understand that line in the log, but it looks like it blocked a connection from a public IP on the internet to the local IP of my PC. How is this possible, given that my router should not let any traffic in? Is there an explanation, or are there any tests I could run to check my setup? In the past I've had to explicitly open ports (with NAT rules) on my router if I wanted somebody to connect to a service running on my PC, so I'd say I'm pretty sure it should be blocking everything by default now, unless something is very wrong.