Need help with IPFW rule

[Norm Vilmer]

I get this message (below) on the console of my FreeBSD 4.10 firewall:

Connection attempt to TCP <my public ip>:20388 from 61.151.248.42:80
flags 0x12

It appears that this is getting through the firewall and is logged to
the console because log_in_vain is 1.

Question: What IPFW rule would block this without interfering with
normal http traffic on port 80 (I have Apache running on the box and
nat'd machines on the inside interface that access the Internet)?