Perma Scans

[chandr0 0]

Hello everyone, I have noticed for a few days (about 4-6) that my pfSense is permanently (almost continuously every second) addressed by an IP. There are all kinds of TCP flags.
This is my public IP, not one of the VPN addresses from here (they are in a different VLAN).
I have observed this for a few days and tried to change my public IP. Each of the four new IP (the GW have also changed) addresses were immediately addressed again and continues in exactly the same way.
A quick check with AbuseDB told me that it was a Dutch domain, although the IP is more likely to come from RU.
I then turned off the VPN with NL Entry (the VPN is from AirVPN) to test whether it is connected to this.
In fact, I noticed today that I don't receive any more scans, at least not from the same IP.
My question now is, was this due to the VPN GW, is someone trying to pass the time?
Or do I have to worry that it's something from my network that's been trying to get to me after the response from outside^^?
 

[OpenSourcerer 1359]

23 hours ago, chandr0 said:

Or do I have to worry that it's something from my network that's been trying to get to me after the response from outside^^?

Most likely this.

[SumRndmDude 22]

I have also been seeing an inordinate amount of traffic hitting my WAN on pfSense the last few days. IP's are from all over the globe and seem to be hitting the same specific ports over and over. I've taken my devices offline one at a time to ensure it's not something from my network dialing out. The oddity for all of it is that the ports are not ones I ever use.