If it's port 433, I would guess that your side ends the connection due to a timeout or something but we end up sending more data. This seems pretty likely to me.
If it's port 53, it might be caused by the reverse DNS lookups that we do. I think this could only happen with rare DNS configurations, though.
Maybe there are some cases where the forum would try to send email to your IP on port 25.
If it happens again I'll keep an eye out for those in the logs.If it's port 53, it might be caused by the reverse DNS lookups that we do. I think this could only happen with rare DNS configurations, though.
Maybe there are some cases where the forum would try to send email to your IP on port 25.
The server should never connect out to port 22.
Actually the way the rule works is that a connection attempt to port 22 will not result in a blacklisting. The actual rule includes a few other ports for servers that I run. The idea is that random hosts on the internet should not be trying to initiate connections to random ports so any that do can be assumed to be up to no good. I expect connections to port 22 though because sometimes I use SSH from outside this network.