Rule being ignored occasionally?

[Evert]

Hi all,

We have an interface named OFFICE where we allow anyone who is on the associated subnet (192.168.24.x) to connect to * on port 80 & 443 (TCP/UDP).
At the bottom of the rule list for this interface there's a rule blocking any traffic from OFFICE to !OFFICE.

When I enable logging on that last rule, I occasionally see requests from OFFICE to external hosts on 443/TCP (occasionally 80/TCP) being blocked.

Why would that traffic reach that rule, given that I allow all traffic on ports 80 and 443 higher up in the rule list?

[zan]

Most likely out-of-state traffic. What are the 'tcpflags' of blocked packets?

[bazbaz]

I have a rule that ALLOWS traffic to 443, that has started to be blocked! Logs report that packet has been dropped cause "Default deny / state violation rule"

Is there some big problem?

[Evert]

Most likely out-of-state traffic. What are the 'tcpflags' of blocked packets?

PA, FPA, RA or A. It varies.