> Here are entries with pass in log enabled: > > 19:59:08.149358 rule 5/0(match): pass in on bce1: 93.174.31.134.36872 > > 38.X.X.X.22: Flags [S], seq 441726758, win 5840, options [mss > 1460,sackOK,TS val 395810874 ecr 0,nop,wscale 7], length 0 And 38.x.x.x is the external ip of your gateway?! (my last guess for today^Wtonight...)