Could anyone please explain me how the deluge torrent client can get incoming requests to my local machine from the Internet, while I'm behind router's firewall and do not have any port forwarding etc.?
Initially I was going to ask about a strange network activity in my LAN, namely continuous incoming requests to 6881 port from different ip addresses, whereas I'd already stopped my torrent client deluge. But while I was composing the question I spotted that these requests ceased, so I concluded that the reason was in the deluge torrent client and the requests continue to come for a while after program's quit. Then I changed ports in the program's settings and the destination port of these requests changed too. So the reason of these requests is deluge.
So here is the situation. I was trying to setup the deluge torrent client, and opened
ufw.log file. And what it showed to me surprised me a lot. It was showing constant incoming requests from different ip addresses to 6881 port. Here is an output of
tail -f /var/log/ufw.log (I've cut sensible data):
Dec 28 18:13:32 foo-host kernel: [44034.890870] [UFW BLOCK] IN=eth0 OUT= MAC=xx:xx SRC=46.182.x.x DST=192.168.xxx.xxx LEN=131 TOS=0x00 PREC=0x00 TTL=50 ID=13882 PROTO=UDP SPT=59696 DPT=6881 LEN=111 Dec 28 18:13:32 foo-host kernel: [44035.682998] [UFW BLOCK] IN=eth0 OUT= MAC=xx:xx SRC=111.240.x.x DST=192.168.xxx.xxx LEN=294 TOS=0x00 PREC=0x00 TTL=113 ID=4012 PROTO=UDP SPT=17621 DPT=6881 LEN=274 Dec 28 18:13:34 foo-host kernel: [44037.400502] [UFW BLOCK] IN=eth0 OUT= MAC=xx:xx SRC=210.187.x.x DST=192.168.xxx.xxx LEN=131 TOS=0x00 PREC=0x00 TTL=55 ID=25753 PROTO=UDP SPT=57274 DPT=6881 LEN=111 Dec 28 18:13:47 foo-host kernel: [44050.142172] [UFW BLOCK] IN=eth0 OUT= MAC=xx:xx SRC=118.81.x.x DST=192.168.xxx.xxx LEN=129 TOS=0x00 PREC=0x00 TTL=46 ID=29946 PROTO=UDP SPT=59765 DPT=6881 LEN=109 Dec 28 18:13:54 foo-host kernel: [44056.727176] [UFW BLOCK] IN=eth0 OUT= MAC=xx:xx SRC=128.127.x.x DST=192.168.xxx.xxx LEN=131 TOS=0x00 PREC=0x00 TTL=113 ID=37504 PROTO=UDP SPT=13835 DPT=6881 LEN=111
So could anyone please give me an answer to this: how do torrent clients (may be only deluge) circumvent router's firewall?
Here is my router's configuration screen shot, so I suppose that the firewall is running. Also I cannot access a local webserver from the outside without port forwarding, so this convinces me more in this conclusion.