Tengo (entre otras) estas reglas en mi configuración de pf:
block drop in log (user) proto udp from any to any port = 137
block drop in log (user) proto udp from any to any port = 138
block drop in log (user) proto udp from any to any port = 139
block drop in log (user) proto udp from any to any port = 445
block drop in log (user) proto tcp from any to any port = 137
block drop in log (user) proto tcp from any to any port = 138
block drop in log (user) proto tcp from any to any port = 139
block drop in log (user) proto tcp from any to any port = 445
pass in proto udp from <192.168-net> to any port = 137 keep state
pass in proto udp from <192.168-net> to any port = 138 keep state
pass in proto udp from <192.168-net> to any port = 139 keep state
pass in proto udp from <192.168-net> to any port = 445 keep state
pass in proto tcp from <192.168-net> to any port = 137 flags S/SA keep state
pass in proto tcp from <192.168-net> to any port = 138 flags S/SA keep state
pass in proto tcp from <192.168-net> to any port = 139 flags S/SA keep state
pass in proto tcp from <192.168-net> to any port = 445 flags S/SA keep state
pass in proto udp from <ipv6-local-nets> to any port = 137 keep state
pass in proto udp from <ipv6-local-nets> to any port = 138 keep state
pass in proto udp from <ipv6-local-nets> to any port = 139 keep state
pass in proto udp from <ipv6-local-nets> to any port = 445 keep state
pass in proto tcp from <ipv6-local-nets> to any port = 137 flags S/SA keep state
pass in proto tcp from <ipv6-local-nets> to any port = 138 flags S/SA keep state
pass in proto tcp from <ipv6-local-nets> to any port = 139 flags S/SA keep state
pass in proto tcp from <ipv6-local-nets> to any port = 445 flags S/SA keep state
Al iniciar sesión veo que
block drop in log (user) proto tcp from any to any port = 445
se activa desde 192.168.2.91. ¿Cómo es eso posible?
pass in proto tcp from <192.168-net> to any port = 445 flags S/SA keep state
Lo mismo sucede regularmente con otro cliente con otro conjunto de reglas (para el puerto de envío). Ambos se conectan por Wifi. Los servicios no parecen verse afectados, por lo que tengo curiosidad por saber cómo es posible que estos mensajes de registro de paquetes bloqueados sean posibles. Sospecho que algo tiene que ver con las banderas, pero no entiendo muy bien cómo pudo suceder eso. ¿Quizás algo con paquetes dañados?
Estoy ejecutando macOS Mojave tanto en el cliente como en el servidor.