OK, have narrowed it down a bit…
Am using these for ports opened and it’s working:
TCP_IN = "20,21,22,25,53,54,80,110,143,443,465,587,993,995,814,5099,5683,8080"
TCP_OUT = "20,21,22,25,53,54,80,110,113,443,587,993,995,5099,5683,8080"
UDP_IN = "20,21,53,54:5683"
UDP_OUT=“20,21,53,54:5683”
So at the moment I’m feeling like it’s a UDP port/range I need to narrow down on.
My trouble is that I can’t seem to monitor UDP traffic easily… have tried using ss but it doesn’t show any UDP traffic if I use the command:
ss -u
I see all the TCP traffic no worries if I use:
ss -t