Firewall Port Range

[rboynton]

I frequently get the following show up on my firewall:
Wingate firewall hit report:

Time: 7/22/2007 3:56:35 PM
Reason: Port Range
Source MAC address: 00-A0-AC-09-24-2D
Destination MAC address: 00-01-02-5F-F7-12
Source IP Address: 148.78.249.202 : 53
Destination IP Address: 148.78.52.14 : 3688
Protocol: UDP
Time-to-live: 60

The source IP is my ISP's DNS server. Is this a problem I should be concerned with?

[genie]

This looks like a leftover of DNS requests - this might happen if your DNS server is fairly slow and UDP firewall hole time outs before the reply arrives. You can change UDP timeouts (for example, for testing purposes, you can create a port action for UDP with longer timeout).

[rboynton]

Is there a recommended timeout setting that I should try? We use two way satellite, so it is slow for sure. We average 1200ms for a ping response to our mail server. I tried a 5 second timeout, but am still getting those firewall notices. Should I go higher?

[rboynton]

On a similar note, one of my other installations shows lots of checksum failures:

Wingate firewall hit report:

Time: 7/23/2007 4:33:38 PM
Reason:
Source MAC address: 00-06-25-66-60-88
Destination MAC address: 00-50-DA-12-D2-A8
Source IP Address: 69.70.86.214 : 42764
Destination IP Address: 192.168.1.254 : 52016
Protocol: TCP
TCP flags: RFPU
Time-to-live: 117

[genie]

Timeout for DNS - well, try 60 sec value first.

As of the last packet you reported - it looks very strange - this set of TCP flags should never be used...