Hi, 2Talk dont have their own sub forum and as they are owned by Vocus I have put it here, mods move it if you think needed.

Anyway, I have a customer that has a business UFB 100/100 connection that is on CG-NAT, I did not set this up, a previous IT supplier did, regardless its doing all they need.

The question I have, is that on the firewall I am seeing continual connection requests on the client WAN interface from three or four sources, these come from subnets belonging to Facebook, Google and Amazon, have not seen any from others but they may be there, these are arriving every 1-3secs, this would imply that there are port forwards or other pin hole through the NAT. 

I also see a regular icmp from a 2Talk address, this I presume is a maintenance probe, but can someone please shed light on the reqests from outside. I note port 443 as the source port but seemingly random dst port in each connection attempt.

Cyril