I have a geth node running on a linux machine, and have set up a firewall (UFW) to allow all outgoing connections, but inbound connections to 30303/udp and 30303/tcp only.
I'm noticing in my system logs that the firewall is blocking a lot of attempts to connect to other ports on my machine. For example:
Jul 8 17:48:23 ethnode-e703e05c4 kernel: [20420.869862] [UFW BLOCK] IN=eth0 OUT= MAC=dc:a6:32:8f:2e:85:2c:79:d7:05:f9:98:08:00 SRC=188.8.131.52 DST=192.168.2.47 LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=TCP SPT=30303 DPT=47962 WINDOW=0 RES=0x00 RST URGP=0
If I'm understanding correctly, this connection attempt originates from port 30303 on the peer (a port used by geth), but is targeting port 47962 on my machine, a port which to my knowledge is not used by geth.
What's happening here? Is this a malicious actor looking for open ports? Or maybe a sign that there are other ports that I need to open on my firewall?
Any insight much appreciated.
Edit: This may be an answer to my own question: The fact that I am allowing outbound connections on any port means that geth will use any port it likes to attempt to establish a connection with other nodes. Then when the other nodes attempt to reply on that port, the firewall blocks it due to my inbound rule. Perhaps someone with a better understanding can confirm or refute that.